Apple Mac OS X Server v10.5 - Open Directory Administration - Mac OS X Server v10.5 - Open Directory Administration
Apple Mac OS X Server v10.5 - Open Directory Administration - Mac OS X Server v10.5 - Open Directory Administration
Apple Mac OS X Server v10.5 - Open Directory Administration - Mac OS X Server v10.5 - Open Directory Administration
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
<strong>Open</strong> <strong>Directory</strong> <strong>Administration</strong><br />
For Version 10.5 Leopard
apple <strong>Apple</strong> Inc.<br />
© 2007 <strong>Apple</strong> Inc. All rights reserved.<br />
The owner or authorized user of a valid copy of<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> software may reproduce this<br />
publication for the purpose of learning to use such<br />
software. No part of this publication may be reproduced<br />
or transmitted for commercial purposes, such as selling<br />
copies of this publication or for providing paid-for<br />
support services.<br />
Every effort has been made to make sure that the<br />
information in this manual is correct. <strong>Apple</strong> Inc., is not<br />
responsible for printing or clerical errors.<br />
<strong>Apple</strong><br />
1 Infinite Loop<br />
Cupertino CA 95014-2084<br />
www.apple.com<br />
The <strong>Apple</strong> logo is a trademark of <strong>Apple</strong> Inc., registered<br />
in the U.S. and other countries. Use of the “keyboard”<br />
<strong>Apple</strong> logo (Option-Shift-K) for commercial purposes<br />
without the prior written consent of <strong>Apple</strong> may<br />
constitute trademark infringement and unfair<br />
competition in violation of federal and state laws.<br />
<strong>Apple</strong>, the <strong>Apple</strong> logo, <strong>Mac</strong>, <strong>Mac</strong>intosh, Xgrid, and<br />
Xserve are trademarks of <strong>Apple</strong> Inc., registered in<br />
the U.S. and other countries. Finder is a trademark of<br />
<strong>Apple</strong> Inc.<br />
Adobe and PostScript are trademarks of Adobe Systems<br />
Incorporated.<br />
UNIX is a registered trademark of The <strong>Open</strong> Group.<br />
Other company and product names mentioned herein<br />
are trademarks of their respective companies. Mention<br />
of third-party products is for informational purposes<br />
only and constitutes neither an endorsement nor a<br />
recommendation. <strong>Apple</strong> assumes no responsibility with<br />
regard to the performance or use of these products.<br />
019-0935/2007-09-01
3 Contents<br />
Preface 11 About This Guide<br />
12 What’s New in Version 10.5<br />
12 What’s in This Guide<br />
14 Using This Guide<br />
14 Using Onscreen Help<br />
15 <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>Administration</strong> Guides<br />
16 Viewing PDF Guides on Screen<br />
16 Printing PDF Guides<br />
17 Getting Documentation Updates<br />
17 Getting Additional Information<br />
Chapter 1 19 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong><br />
19 Benefits of Using <strong>Directory</strong> Services<br />
20 <strong>Directory</strong> Services and <strong>Directory</strong> Domains<br />
21 A Historical Perspective<br />
21 Data Consolidation<br />
23 Data Distribution<br />
24 Uses of <strong>Directory</strong> Data<br />
25 Access to <strong>Directory</strong> Services<br />
25 Inside a <strong>Directory</strong> Domain<br />
27 Structure of LDAP <strong>Directory</strong> Information<br />
28 Local and Shared <strong>Directory</strong> Domains<br />
28 About the Local <strong>Directory</strong> Domain<br />
29 About Shared <strong>Directory</strong> Domains<br />
30 Shared Data in Existing <strong>Directory</strong> Domains<br />
30 SMB Services and <strong>Open</strong> <strong>Directory</strong><br />
31 <strong>Open</strong> <strong>Directory</strong> as a Primary Domain Controller<br />
32 <strong>Open</strong> <strong>Directory</strong> as a BDC<br />
Chapter 2 33 <strong>Open</strong> <strong>Directory</strong> Search Policies<br />
33 Search Policy Levels<br />
33 Local <strong>Directory</strong> Domain Search Policy<br />
34 Two-Level Search Policies<br />
3
35 Multilevel Search Policies<br />
36 Automatic Search Policies<br />
38 Custom Search Policies<br />
38 Search Policies for Authentication and Contacts<br />
Chapter 3 39 <strong>Open</strong> <strong>Directory</strong> Authentication<br />
40 Password Types<br />
40 Authentication and Authorization<br />
41 <strong>Open</strong> <strong>Directory</strong> Passwords<br />
41 Shadow Passwords<br />
42 Crypt Passwords<br />
42 Providing Secure Authentication for Windows Users<br />
43 Offline Attacks on Passwords<br />
44 Determining Which Authentication Option to Use<br />
45 Password Policies<br />
46 Single Sign-On Authentication<br />
46 Kerberos Authentication<br />
47 Breaking the Barriers to Kerberos Deployment<br />
48 Single Sign-On Experience<br />
48 Secure Authentication<br />
49 Ready to Move Beyond Passwords<br />
49 Multiplatform Authentication<br />
49 Centralized Authentication<br />
50 Kerberized Services<br />
50 Configuring Services for Kerberos After Upgrading<br />
51 Kerberos Principals and Realms<br />
51 Kerberos Authentication Process<br />
52 <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> and Shadow Password Authentication Methods<br />
54 Disabling <strong>Open</strong> <strong>Directory</strong> Authentication Methods<br />
55 Disabling Shadow Password Authentication Methods<br />
56 Contents of the <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> Database<br />
56 LDAP Bind Authentication<br />
Chapter 4 57 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools<br />
58 General Planning Guidelines<br />
61 Estimating <strong>Directory</strong> and Authentication Requirements<br />
62 Identifying <strong>Server</strong>s for Hosting Shared Domains<br />
62 Replicating <strong>Open</strong> <strong>Directory</strong> Services<br />
63 Replica Sets<br />
64 Cascading Replication<br />
65 Planning the Upgrade of Multiple <strong>Open</strong> <strong>Directory</strong> Replicas<br />
65 Load Balancing in Small, Medium, and Large Environments<br />
66 Replication in a Multibuilding Campus<br />
4 Contents
66 Using an <strong>Open</strong> <strong>Directory</strong> Master, Replica, or Relay with NAT<br />
67 <strong>Open</strong> <strong>Directory</strong> Master and Replica Compatibility<br />
67 Mixing Active <strong>Directory</strong> and <strong>Open</strong> <strong>Directory</strong> Master and Replica Services<br />
69 Integrating with Existing <strong>Directory</strong> Domains<br />
70 Integrating Without Schema Changes<br />
70 Integrating with Schema Changes<br />
70 Avoiding Kerberos Conflicts with Multiple Directories<br />
72 Improving Performance and Redundancy<br />
73 <strong>Open</strong> <strong>Directory</strong> Security<br />
74 Service Access Control Lists (SACLs)<br />
75 Tiered <strong>Administration</strong><br />
75 Tools for Managing <strong>Open</strong> <strong>Directory</strong> Services<br />
76 <strong>Server</strong> Admin<br />
77 <strong>Directory</strong> Utility<br />
77 Workgroup Manager<br />
78 Command-Line Tools<br />
Chapter 5 79 Setting Up <strong>Open</strong> <strong>Directory</strong> Services<br />
79 Setup Overview<br />
80 Before You Begin<br />
81 Managing <strong>Open</strong> <strong>Directory</strong> on a Remote <strong>Server</strong><br />
81 Turning <strong>Open</strong> <strong>Directory</strong> On<br />
81 Setting Up a Standalone <strong>Directory</strong> Service<br />
83 Setting Up an <strong>Open</strong> <strong>Directory</strong> Master<br />
85 Instructing Users How to Log In<br />
85 Setting Up a Primary Domain Controller<br />
86 Setting Up Windows Vista for Domain Login<br />
87 Setting Up Windows XP for Domain Login<br />
87 Setting Up Windows 2000 for Domain Login<br />
88 Setting Up an <strong>Open</strong> <strong>Directory</strong> Replica<br />
90 Creating Multiple Replicas of an <strong>Open</strong> <strong>Directory</strong> Master<br />
91 Setting Up <strong>Open</strong> <strong>Directory</strong> Relays for Cascading Replication<br />
91 Setting Up a <strong>Server</strong> as a BDC<br />
92 Setting Up <strong>Open</strong> <strong>Directory</strong> Failover<br />
93 Setting Up a Connection to a <strong>Directory</strong> <strong>Server</strong><br />
94 Setting Up a <strong>Server</strong> as a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> PDC Domain Member<br />
95 Setting Up a <strong>Server</strong> as an Active <strong>Directory</strong> Domain Member<br />
97 Setting Up Single Sign-On Kerberos Authentication<br />
98 Setting Up an <strong>Open</strong> <strong>Directory</strong> Kerberos Realm<br />
99 Starting Kerberos After Setting Up an <strong>Open</strong> <strong>Directory</strong> Master<br />
100 Delegating Authority to Join an <strong>Open</strong> <strong>Directory</strong> Kerberos Realm<br />
102 Joining a <strong>Server</strong> to a Kerberos Realm<br />
Contents 5
Chapter 6 105 Managing User Authentication<br />
106 Composing a Password<br />
106 Changing a User’s Password<br />
107 Resetting the Passwords of Multiple Users<br />
108 Changing a User’s Password Type<br />
108 Changing the Password Type to <strong>Open</strong> <strong>Directory</strong><br />
110 Changing the Password Type to Crypt Password<br />
110 Changing the Password Type to Shadow Password<br />
111 Enabling Single Sign-On Kerberos Authentication for a User<br />
111 Changing the Global Password Policy<br />
112 Setting Password Policies for Individual Users<br />
113 Selecting Authentication Methods for Shadow Password Users<br />
114 Selecting Authentication Methods for <strong>Open</strong> <strong>Directory</strong> Passwords<br />
115 Assigning Administrator Rights for <strong>Open</strong> <strong>Directory</strong> Authentication<br />
116 Keeping the Primary Administrator’s Passwords in Sync<br />
116 Enabling LDAP Bind Authentication for a User<br />
117 Setting Passwords of Exported or Imported Users<br />
117 Migrating Passwords From <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.1 or Earlier<br />
Chapter 7 119 Managing <strong>Directory</strong> Clients<br />
119 Connecting Clients to <strong>Directory</strong> <strong>Server</strong>s<br />
119 About <strong>Directory</strong> <strong>Server</strong> Connections<br />
120 Automated Client Configuration<br />
121 Adding an Active <strong>Directory</strong> <strong>Server</strong> Connection<br />
121 Adding an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong> Connection<br />
122 Removing a <strong>Directory</strong> <strong>Server</strong> Connection<br />
122 Editing a <strong>Directory</strong> <strong>Server</strong> Connection<br />
123 Monitoring <strong>Directory</strong> <strong>Server</strong> Connections<br />
123 Managing the Root User Account<br />
123 Enabling the Root User Account<br />
124 Changing the Root User Account Password<br />
Chapter 8 125 Advanced <strong>Directory</strong> Client Settings<br />
125 About Advanced <strong>Directory</strong> Services Settings<br />
126 Setting Up <strong>Directory</strong> Utility on a Remote <strong>Server</strong><br />
126 Configuring Mount Records for a Computer’s Local <strong>Directory</strong> Domain<br />
126 Adding a Mount Record to the Local <strong>Directory</strong> Domain<br />
127 Removing a Mount Record from the Local <strong>Directory</strong> Domain<br />
128 Editing a Mount Record in the Local <strong>Directory</strong> Domain<br />
128 Using Advanced Search Policy Settings<br />
129 Defining Automatic Search Policies<br />
130 Defining Custom Search Policies<br />
131 Defining Local <strong>Directory</strong> Search Policies<br />
6 Contents
131 Waiting for a Search Policy Change to Take Effect<br />
131 Protecting Computers from a Malicious DHCP <strong>Server</strong><br />
132 Using Advanced <strong>Directory</strong> Services Settings<br />
132 Enabling or Disabling Active <strong>Directory</strong> Service<br />
133 Enabling or Disabling LDAP <strong>Directory</strong> Services<br />
133 Using Advanced LDAP Service Settings<br />
134 Accessing LDAP Directories in Mail and Address Book<br />
134 Enabling or Disabling Use of a DHCP-Supplied LDAP <strong>Directory</strong><br />
135 Showing or Hiding Configurations for LDAP <strong>Server</strong>s<br />
136 Configuring Access to an LDAP <strong>Directory</strong><br />
138 Configuring Access to an LDAP <strong>Directory</strong> Manually<br />
140 Changing a Configuration for Accessing an LDAP <strong>Directory</strong><br />
141 Duplicating a Configuration for Accessing an LDAP <strong>Directory</strong><br />
143 Deleting a Configuration for Accessing an LDAP <strong>Directory</strong><br />
144 Changing the Connection Settings for an LDAP <strong>Directory</strong><br />
145 Changing the Security Policy for an LDAP Connection<br />
146 Configuring LDAP Searches and Mappings<br />
149 Setting Up Trusted Binding for an LDAP <strong>Directory</strong><br />
150 Stopping Trusted Binding with an LDAP <strong>Directory</strong><br />
150 Changing the <strong>Open</strong>/Close Timeout for an LDAP Connection<br />
151 Changing the Query Timeout for an LDAP Connection<br />
151 Changing the Rebind-Try Delay Time for an LDAP Connection<br />
152 Changing the Idle Timeout for an LDAP Connection<br />
152 Forcing Read-Only LDAPv2 Access<br />
152 Ignoring LDAP <strong>Server</strong> Referrals<br />
153 Authenticating an LDAP Connection<br />
153 Changing the Password Used for Authenticating an LDAP Connection<br />
154 Mapping Config Record Attributes for LDAP Directories<br />
154 Editing RFC 2307 Mapping to Enable Creating Users<br />
155 Preparing a Read-Only LDAP <strong>Directory</strong> for <strong>Mac</strong> <strong>OS</strong> X<br />
155 Populating LDAP Directories with Data for <strong>Mac</strong> <strong>OS</strong> X<br />
156 Using Advanced Active <strong>Directory</strong> Service Settings<br />
157 About Active <strong>Directory</strong> Access<br />
159 Configuring Access to an Active <strong>Directory</strong> Domain<br />
161 Setting Up Mobile User Accounts in Active <strong>Directory</strong><br />
162 Setting Up Home Folders for Active <strong>Directory</strong> User Accounts<br />
163 Setting a UNIX Shell for Active <strong>Directory</strong> User Accounts<br />
163 Mapping the UID to an Active <strong>Directory</strong> Attribute<br />
164 Mapping the Primary Group ID to an Active <strong>Directory</strong> Attribute<br />
165 Mapping the Group ID in Group Accounts to an Active <strong>Directory</strong> Attribute<br />
166 Specifying a Preferred Active <strong>Directory</strong> <strong>Server</strong><br />
166 Changing the Active <strong>Directory</strong> Groups That Can Administer the Computer<br />
167 Controlling Authentication from All Domains in the Active <strong>Directory</strong> Forest<br />
Contents 7
168 Unbinding from the Active <strong>Directory</strong> <strong>Server</strong><br />
168 Editing User Accounts and Other Records in Active <strong>Directory</strong><br />
169 Setting Up LDAP Access to Active <strong>Directory</strong> Domains<br />
170 Specifying NIS Settings<br />
171 Specifying BSD Configuration File Settings<br />
171 Setting Up Data in BSD Configuration Files<br />
Chapter 9 173 Maintaining <strong>Open</strong> <strong>Directory</strong> Services<br />
173 Controlling Access to <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>s and Services<br />
174 Controlling Access to a <strong>Server</strong>’s Login Window<br />
174 Controlling Access to SSH Service<br />
175 Configuring Service Access Control<br />
176 Configuring Record Privileges<br />
177 Monitoring <strong>Open</strong> <strong>Directory</strong><br />
177 Checking the Status of an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong><br />
177 Monitoring Replicas and Replays of an <strong>Open</strong> <strong>Directory</strong> Master<br />
178 Viewing <strong>Open</strong> <strong>Directory</strong> Status and Logs<br />
178 Monitoring <strong>Open</strong> <strong>Directory</strong> Authentication<br />
179 Viewing and Editing <strong>Directory</strong> Data<br />
179 Showing the <strong>Directory</strong> Inspector<br />
180 Hiding the <strong>Directory</strong> Inspector<br />
180 Setting <strong>Directory</strong> Access Controls (DACs)<br />
180 Deleting Records<br />
181 Deleting Users or Computers Using Inspector or the Command Line<br />
182 Changing a User’s Short Name<br />
183 Importing Records of Any Type<br />
183 Setting Options for an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong><br />
184 Setting a Binding Policy for an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong><br />
184 Setting a Security Policy for an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong><br />
186 Changing the Location of an LDAP Database<br />
186 Limiting Search Results for LDAP Service<br />
187 Setting the Search Timeout Interval for LDAP Service<br />
187 Setting up SSL for LDAP Service<br />
188 Creating a Custom SSL Configuration for LDAP<br />
189 Managing <strong>Open</strong> <strong>Directory</strong> Replication<br />
189 Scheduling Replication of an <strong>Open</strong> <strong>Directory</strong> Master or Primary Domain Controller<br />
(PDC)<br />
190 Synchronizing an <strong>Open</strong> <strong>Directory</strong> Replica or BDC on Demand<br />
190 Making an <strong>Open</strong> <strong>Directory</strong> Replica into a Relay<br />
190 Promoting an <strong>Open</strong> <strong>Directory</strong> Replica<br />
193 Decommissioning an <strong>Open</strong> <strong>Directory</strong> Replica<br />
194 Archiving an <strong>Open</strong> <strong>Directory</strong> Master<br />
195 Restoring an <strong>Open</strong> <strong>Directory</strong> Master<br />
8 Contents
Chapter 10 199 Solving <strong>Open</strong> <strong>Directory</strong> Problems<br />
199 Solving <strong>Open</strong> <strong>Directory</strong> Master and Replica Problems<br />
199 If Kerberos Is Stopped on an <strong>Open</strong> <strong>Directory</strong> Master or Replica<br />
200 If You Can’t Create an <strong>Open</strong> <strong>Directory</strong> Replica<br />
200 If You Can’t Create an <strong>Open</strong> <strong>Directory</strong> Master or Replica from a Configuration File<br />
200 If You Can’t Connect a Replica to Your Relay<br />
200 If You Can’t Join an <strong>Open</strong> <strong>Directory</strong> Replica to an <strong>Open</strong> <strong>Directory</strong> that is a<br />
Subordinate of an Active <strong>Directory</strong> <strong>Server</strong><br />
201 Solving <strong>Directory</strong> Connection Problems<br />
201 If a Delay Occurs During Startup<br />
201 Solving Authentication Problems<br />
201 If You Can’t Change a User’s <strong>Open</strong> <strong>Directory</strong> Password<br />
201 If a User Can’t Access Some Services<br />
202 If a User Can’t Authenticate for VPN Service<br />
202 If You Can’t Change a User’s Password Type to <strong>Open</strong> <strong>Directory</strong><br />
202 If Users Relying on a Password <strong>Server</strong> Can’t Log In<br />
202 If Users Can’t Log In with Accounts in a Shared <strong>Directory</strong> Domain<br />
203 If You Can’t Log In as an Active <strong>Directory</strong> User<br />
203 If Users Can’t Authenticate Using Single Sign-On Kerberos<br />
205 If Users Can’t Change Their Passwords<br />
205 If You Can’t Join a <strong>Server</strong> to an <strong>Open</strong> <strong>Directory</strong> Kerberos Realm<br />
206 If You Must Reset an Administrator Password<br />
Appendix 207 <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data<br />
208 <strong>Open</strong> <strong>Directory</strong> Extensions to LDAP Schema<br />
209 Object Classes in <strong>Open</strong> <strong>Directory</strong> LDAP Schema<br />
217 Attributes in <strong>Open</strong> <strong>Directory</strong> LDAP Schema<br />
237 Mapping Standard Record Types and Attributes to LDAP and Active <strong>Directory</strong><br />
238 Mappings for Users<br />
241 Mappings for Groups<br />
242 Mappings for Mounts<br />
243 Mappings for Computers<br />
244 Mappings for ComputerLists<br />
245 Mappings for Config<br />
246 Mappings for People<br />
248 Mappings for PresetComputerLists<br />
248 Mappings for PresetGroups<br />
249 Mappings for PresetUsers<br />
251 Mappings for Printers<br />
252 Mappings for Auto<strong>Server</strong>Setup<br />
253 Mappings for Locations<br />
253 Standard <strong>Open</strong> <strong>Directory</strong> Record Types and Attributes<br />
253 Standard Attributes in User Records<br />
Contents 9
Glossary 263<br />
Index 271<br />
258 Standard Attributes in Group Records<br />
259 Standard Attributes in Computer Records<br />
260 Standard Attributes in Computer Group Records<br />
261 Standard Attributes in Mount Records<br />
262 Standard Attributes in Config Records<br />
10 Contents
About This Guide<br />
Preface<br />
This guide describes the directory and authentication<br />
services you can set up using <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>. It also<br />
explains how to configure <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> and <strong>Mac</strong> <strong>OS</strong> X<br />
client computers for directory services.<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>’s <strong>Open</strong> <strong>Directory</strong> provides directory and authentication services for<br />
mixed networks of <strong>Mac</strong> <strong>OS</strong> X, Windows, and UNIX computers.<br />
<strong>Open</strong> <strong>Directory</strong> uses <strong>Open</strong>LDAP, the open source implementation of Lightweight<br />
<strong>Directory</strong> Access Protocol (LDAP), to provide directory services. It’s compatible with<br />
other standards-based LDAP servers, and can be integrated with proprietary services<br />
such as Microsoft’s Active <strong>Directory</strong> and Novell’s e<strong>Directory</strong>.<br />
For the LDAP database backend, <strong>Open</strong> <strong>Directory</strong> uses the open source Berkeley<br />
Database. It’s a highly scalable database for high-performance indexing of hundreds of<br />
thousands of user accounts and other records.<br />
<strong>Open</strong> <strong>Directory</strong> plug-ins enable a <strong>Mac</strong> <strong>OS</strong> X client or <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> computer to read<br />
and write authoritative information about users and network resources from any LDAP<br />
server—even Microsoft’s proprietary Active <strong>Directory</strong>. The server can also access<br />
records in legacy directories such as NIS and local BSD configuration files (/etc).<br />
<strong>Open</strong> <strong>Directory</strong> also provides authentication service. It can securely store and validate<br />
the passwords of users who want to log in to client computers on your network or to<br />
use other network resources that require authentication. <strong>Open</strong> <strong>Directory</strong> can enforce<br />
such policies as password expiration and minimum length. <strong>Open</strong> <strong>Directory</strong> can also<br />
authenticate Windows computer users for domain log in, file service, and other<br />
Windows services (SMB services) provided by <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>.<br />
An MIT Kerberos Key Distribution Center (KDC) is fully integrated with <strong>Open</strong> <strong>Directory</strong><br />
and provides strong authentication with support for secure single sign-on. This means<br />
users can authenticate only once, with a single user name and password pair, for access<br />
to the range of Kerberos-enabled network services.<br />
11
For services that don’t accept Kerberos authentication, the integrated Secure<br />
Authentication and Service Layer (SASL) service negotiates the strongest possible<br />
authentication mechanism.<br />
In addition, directory and authentication replication maximizes availability and<br />
scalability. By creating replicas of <strong>Open</strong> <strong>Directory</strong> servers, you can easily maintain<br />
failover servers and remote servers for fast client interaction on distributed networks.<br />
What’s New in Version 10.5<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> version 10.5 offers the following major enhancements in <strong>Open</strong><br />
<strong>Directory</strong>:<br />
 Simplified configuration of LDAPv3 access: <strong>Directory</strong> Utility assists you in setting<br />
up a connection to an LDAP directory.<br />
 Improved <strong>Server</strong> Admin Interface: <strong>Server</strong> Admin has an easier-to-use interface.<br />
 Improved Authorization: You can have a <strong>Mac</strong> <strong>OS</strong> X <strong>Open</strong> <strong>Directory</strong> server join an<br />
Active <strong>Directory</strong> server and use cross-domain authorization.<br />
 Improved LDAP server: <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong> uses <strong>Open</strong>LDAP version 2.3.x and<br />
Berkeley DB version 4.2.52.<br />
 Improved local domain: <strong>Mac</strong> <strong>OS</strong> X uses a local directory domain for local computer<br />
authentication.<br />
 Improved replication: You can have a two-tier replication of a single master<br />
(also referred to as cascading replication). This gives you up to 1056 replicas of a<br />
single <strong>Open</strong> <strong>Directory</strong> master and more efficient replica sets or replica picking for<br />
password server, LDAP, and Kerberos.<br />
 Improved <strong>Administration</strong>: You can have more scalability of directory domain<br />
administration by using tiered administration.<br />
 Improved Application support: You can use <strong>Open</strong> <strong>Directory</strong> with applications such<br />
as <strong>Apple</strong> Wiki.<br />
What’s in This Guide<br />
This guide includes the following chapters:<br />
 Chapter 1, “<strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong>,” explains what directory domains<br />
are, how they are used, and how they are organized.<br />
 Chapter 2, “<strong>Open</strong> <strong>Directory</strong> Search Policies,” describes search policies with one or<br />
more directory domains, and describes automatic, custom, and local-only search<br />
policies.<br />
 Chapter 3, “<strong>Open</strong> <strong>Directory</strong> Authentication,” describes <strong>Open</strong> <strong>Directory</strong> authentication,<br />
shadow and crypt passwords, Kerberos, LDAP bind, and single sign-on.<br />
12 Preface About This Guide
 Chapter 4, “<strong>Open</strong> <strong>Directory</strong> Planning and Management Tools,” helps you assess your<br />
directory domain needs, estimate directory and authentication requirements, identify<br />
servers for hosting shared domains, improve performance and redundancy, deal with<br />
replication in a multibuilding campus, and make your <strong>Open</strong> <strong>Directory</strong> services<br />
secure. This chapter also introduces the tools you use to manage <strong>Open</strong> <strong>Directory</strong><br />
services.<br />
 Chapter 5, “Setting Up <strong>Open</strong> <strong>Directory</strong> Services,” tells you how to set up an<br />
<strong>Open</strong> <strong>Directory</strong> server and explains the configurations and roles you can configure.<br />
This chapter also tells you how to set options of the LDAP service of an <strong>Open</strong><br />
<strong>Directory</strong> master or replica and explains how to set up single sign-on Kerberos<br />
authentication on an <strong>Open</strong> <strong>Directory</strong> master.<br />
 Chapter 6, “Managing User Authentication,” describes how to set password policies,<br />
change a user’s password type, assign administrator rights for <strong>Open</strong> <strong>Directory</strong><br />
authentication, reset passwords of imported user accounts, and migrate passwords<br />
to <strong>Open</strong> <strong>Directory</strong> authentication.<br />
 Chapter 7, “Managing <strong>Directory</strong> Clients,” explains how to use <strong>Directory</strong> Utility to<br />
configure and manage how <strong>Mac</strong> <strong>OS</strong> X computers access directory services.<br />
 Chapter 8, “Advanced <strong>Directory</strong> Client Settings,” explains how to use the <strong>Directory</strong><br />
Utility application to enable, disable, and configure service discovery protocols.<br />
It also explains how to configure authentication and contacts search policies and<br />
explains how to configure access to directory domains, including LDAP, Active<br />
<strong>Directory</strong>, NIS, and BSD configuration files.<br />
 Chapter 9, “Maintaining <strong>Open</strong> <strong>Directory</strong> Services,” tells you how to monitor <strong>Open</strong><br />
<strong>Directory</strong> services, view and edit directory data with the Inspector, archive an <strong>Open</strong><br />
<strong>Directory</strong> master, and perform other directory maintenance.<br />
 Chapter 10, “Solving <strong>Open</strong> <strong>Directory</strong> Problems,” describes common problems and<br />
provides information on what to do if you encounter problems while working with<br />
<strong>Open</strong> <strong>Directory</strong>.<br />
In addition, the Appendix, “<strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data,” lists the <strong>Open</strong> <strong>Directory</strong><br />
extensions to the LDAP schema and specifies the standard record types and attributes<br />
of <strong>Mac</strong> <strong>OS</strong> X. Finally, the Glossary defines terms you’ll encounter as you read this guide.<br />
Note: Because <strong>Apple</strong> periodically releases new versions and updates to its software,<br />
images shown in this book may be different from what you see on your screen.<br />
Preface About This Guide 13
Using This Guide<br />
The chapters in this guide are arranged in the order that you’re likely to need them<br />
when setting up and managing <strong>Open</strong> <strong>Directory</strong> on your server:<br />
 Read Chapter 1 through Chapter 3 to acquaint yourself with <strong>Open</strong> <strong>Directory</strong><br />
concepts: directory services, search policies, and authentication.<br />
 Read Chapter 4 when you’re ready to plan directory services and password<br />
authentication for your network.<br />
 After you finish planning, use the instructions in Chapter 5 to set up <strong>Open</strong> <strong>Directory</strong><br />
services.<br />
 When you must set password policies or change password settings for a user<br />
account, look for instructions in Chapter 6.<br />
 To set up or change how a <strong>Mac</strong> <strong>OS</strong> X or <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> computer accesses<br />
directory domains, follow the instructions in Chapter 7.<br />
 To configure advanced settings for users using <strong>Directory</strong> Utility, use Chapter 8.<br />
 For ongoing maintenance of directory and authentication services, use Chapter 9.<br />
 If you have problems with <strong>Open</strong> <strong>Directory</strong>, use Chapter 10 to investigate possible<br />
solutions.<br />
Using Onscreen Help<br />
You can get task instructions on screen in Help Viewer while you’re managing Leopard<br />
<strong>Server</strong>. You can view help on a server or an administrator computer. (An administrator<br />
computer is a <strong>Mac</strong> <strong>OS</strong> X computer with Leopard <strong>Server</strong> administration software<br />
installed on it.)<br />
To get help for an advanced configuration of Leopard <strong>Server</strong>:<br />
m <strong>Open</strong> <strong>Server</strong> Admin or Workgroup Manager and then:<br />
 Use the Help menu to search for a task you want to perform.<br />
 Choose Help > <strong>Server</strong> Admin Help or Help > Workgroup Manager Help to browse<br />
and search the help topics.<br />
The onscreen help contains instructions taken from <strong>Server</strong> <strong>Administration</strong> and other<br />
advanced administration guides described in “<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>Administration</strong> Guides”<br />
on page 15.<br />
To see the most recent server help topics:<br />
m Make sure the server or administrator computer is connected to the Internet while<br />
you’re getting help.<br />
Help Viewer automatically retrieves and caches the most recent server help topics<br />
from the Internet. When not connected to the Internet, Help Viewer displays cached<br />
help topics.<br />
14 Preface About This Guide
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>Administration</strong> Guides<br />
Getting Started covers installation and setup for standard and workgroup configurations<br />
of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>. For advanced configurations, <strong>Server</strong> <strong>Administration</strong> covers planning,<br />
installation, setup, and general server administration. A suite of additional guides, listed<br />
below, covers advanced planning, setup, and management of individual services. You<br />
can get these guides in PDF format from the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> documentation website:<br />
www.apple.com/server/documentation<br />
This guide...<br />
Getting Started and<br />
Installation & Setup Worksheet<br />
Command-Line <strong>Administration</strong><br />
File Services <strong>Administration</strong><br />
iCal Service <strong>Administration</strong><br />
iChat Service <strong>Administration</strong><br />
<strong>Mac</strong> <strong>OS</strong> X Security Configuration<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> Security<br />
Configuration<br />
Mail Service <strong>Administration</strong><br />
Network Services <strong>Administration</strong><br />
<strong>Open</strong> <strong>Directory</strong> <strong>Administration</strong><br />
Podcast Producer <strong>Administration</strong><br />
Print Service <strong>Administration</strong><br />
QuickTime Streaming and<br />
Broadcasting <strong>Administration</strong><br />
<strong>Server</strong> <strong>Administration</strong><br />
System Imaging and Software<br />
Update <strong>Administration</strong><br />
Upgrading and Migrating<br />
tells you how to:<br />
Install <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> and set it up for the first time.<br />
Install, set up, and manage <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> using UNIX commandline<br />
tools and configuration files.<br />
Share selected server volumes or folders among server clients<br />
using the AFP, NFS, FTP, and SMB protocols.<br />
Set up and manage iCal shared calendar service.<br />
Set up and manage iChat instant messaging service.<br />
Make <strong>Mac</strong> <strong>OS</strong> X computers (clients) more secure, as required by<br />
enterprise and government customers.<br />
Make <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> and the computer it’s installed on more<br />
secure, as required by enterprise and government customers.<br />
Set up and manage IMAP, POP, and SMTP mail services on<br />
the server.<br />
Set up, configure, and administer DHCP, DNS, VPN, NTP, IP firewall,<br />
NAT, and RADIUS services on the server.<br />
Set up and manage directory and authentication services, and<br />
configure clients to access directory services.<br />
Set up and manage Podcast Producer service to record, process,<br />
and distribute podcasts.<br />
Host shared printers and manage their associated queues and<br />
print jobs.<br />
Capture and encode QuickTime content. Set up and manage<br />
QuickTime streaming service to deliver media streams live or<br />
on demand.<br />
Perform advanced installation and setup of server software, and<br />
manage options that apply to multiple services or to the server as<br />
a whole.<br />
Use NetBoot, NetInstall, and Software Update to automate the<br />
management of operating system and other software used by<br />
client computers.<br />
Use data and service settings from an earlier version of <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> or Windows NT.<br />
Preface About This Guide 15
This guide...<br />
User Management<br />
Web Technologies <strong>Administration</strong><br />
Xgrid <strong>Administration</strong> and High<br />
Performance Computing<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> Glossary<br />
tells you how to:<br />
Create and manage user accounts, groups, and computers. Set up<br />
managed preferences for <strong>Mac</strong> <strong>OS</strong> X clients.<br />
Set up and manage web technologies, including web, blog,<br />
webmail, wiki, MySQL, PHP, Ruby on Rails, and WebDAV.<br />
Set up and manage computational clusters of Xserve systems and<br />
<strong>Mac</strong> computers.<br />
Learn about terms used for server and storage products.<br />
Viewing PDF Guides on Screen<br />
While reading the PDF version of a guide onscreen:<br />
 Show bookmarks to see the guide’s outline, and click a bookmark to jump to the<br />
corresponding section.<br />
 Search for a word or phrase to see a list of places where it appears in the document.<br />
Click a listed place to see the page where it occurs.<br />
 Click a cross-reference to jump to the referenced section. Click a web link to visit the<br />
website in your browser.<br />
Printing PDF Guides<br />
If you want to print a guide, you can take these steps to save paper and ink:<br />
 Save ink or toner by not printing the cover page.<br />
 Save color ink on a color printer by looking in the panes of the Print dialog for an<br />
option to print in grays or black and white.<br />
 Reduce the bulk of the printed document and save paper by printing more than one<br />
page per sheet of paper. In the Print dialog, change Scale to 115% (155% for Getting<br />
Started). Then choose Layout from the untitled pop-up menu. If your printer supports<br />
two-sided (duplex) printing, select one of the Two-Sided options. Otherwise, choose<br />
2 from the Pages per Sheet pop-up menu, and optionally choose Single Hairline from<br />
the Border menu. (If you’re using <strong>Mac</strong> <strong>OS</strong> X v10.4 or earlier, the Scale setting is in the<br />
Page Setup dialog and the Layout settings are in the Print dialog.)<br />
You may want to enlarge the printed pages even if you don’t print double sided,<br />
because the PDF page size is smaller than standard printer paper. In the Print dialog<br />
or Page Setup dialog, try changing Scale to 115% (155% for Getting Started, which has<br />
CD-size pages).<br />
16 Preface About This Guide
Getting Documentation Updates<br />
Periodically, <strong>Apple</strong> posts revised help pages and new editions of guides. Some revised<br />
help pages update the latest editions of the guides.<br />
 To view new onscreen help topics for a server application, make sure your server or<br />
administrator computer is connected to the Internet and click “Latest help topics” or<br />
“Staying current” in the main help page for the application.<br />
 To download the latest guides in PDF format, go to the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
documentation website:<br />
www.apple.com/server/documentation<br />
Getting Additional Information<br />
For more information, consult these resources:<br />
 Read Me documents—important updates and special information. Look for them on<br />
the server discs.<br />
 <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> website (www.apple.com/server/macosx)—gateway to extensive<br />
product and technology information.<br />
 <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> Support website (www.apple.com/support/macosxserver)—access to<br />
hundreds of articles from <strong>Apple</strong>’s support organization.<br />
 <strong>Apple</strong> Service & Support website (www.apple.com/support)—access to hundreds of<br />
articles from <strong>Apple</strong>’s support organization.<br />
 <strong>Apple</strong> Training website (www.apple.com/training)—instructor-led and self-paced<br />
courses for honing your server administration skills.<br />
 <strong>Apple</strong> Discussions website (discussions.apple.com)—a way to share questions,<br />
knowledge, and advice with other administrators.<br />
 <strong>Apple</strong> Mailing Lists website (www.lists.apple.com)—subscribe to mailing lists so you<br />
can communicate with other administrators using email.<br />
 <strong>Open</strong>LDAP website (www.openldap.org)—learn about the open source software that<br />
<strong>Open</strong> <strong>Directory</strong> uses to provide LDAP directory service.<br />
 MIT Kerberos website (web.mit.edu/kerberos/www)—get background information and<br />
specifications for the protocol that <strong>Open</strong> <strong>Directory</strong> uses to provide robust single signon<br />
authentication.<br />
 Berkeley DB website (www.sleepycat.com)—investigate feature descriptions and<br />
technical documentation for the open source database that <strong>Open</strong> <strong>Directory</strong> uses to<br />
store LDAP directory data.<br />
 RFC3377, “Lightweight <strong>Directory</strong> Access Protocol (v3): Technical Specification”<br />
(www.rfc-editor.org/rfc/rfc3377.txt)—lists a set of eight other Request for Comment<br />
(RFC) documents with overview information and detailed specifications for the<br />
LDAPv3 protocol.<br />
Preface About This Guide 17
18 Preface About This Guide
1 <strong>Directory</strong><br />
Services with <strong>Open</strong><br />
<strong>Directory</strong><br />
1<br />
A directory service provides a central repository for<br />
information about computer users and network resources in<br />
an organization.<br />
Benefits of Using <strong>Directory</strong> Services<br />
Storing administrative data in a central repository has many benefits:<br />
 Reduces data entry effort<br />
 Certifies that network services and clients have consistent information about users<br />
and resources<br />
 Simplifies administration of users and resources<br />
 Provides identification, authentication, and authorization information for other<br />
network services<br />
In education and enterprise environments, directory services are the ideal way to<br />
manage users and computing resources. Organizations with as few as 10 people can<br />
benefit by deploying a directory service.<br />
<strong>Directory</strong> services are doubly beneficial: they simplify system and network<br />
administration, and they simplify a user’s experience on the network.<br />
With directory services, administrators can maintain information about all users—such<br />
as their names, passwords, and locations of network home directories—centrally rather<br />
than on each computer. <strong>Directory</strong> services can also maintain centralized information<br />
about printers, computers, and other network resources.<br />
Centralizing information about users and resources can reduce the system<br />
administrator’s information management burden, and each user has a centralized user<br />
account for logging in on any authorized computer on the network.<br />
With centralized directory service and file service set up to host network home folders,<br />
wherever a user logs in, the user gets the same home folder, personal desktop, and<br />
individual preferences. The user always has access to personal networked files and can<br />
easily locate and use authorized network resources.<br />
19
<strong>Directory</strong> Services and <strong>Directory</strong> Domains<br />
A directory service acts as an intermediary between application and system software<br />
processes, which need information about users and resources, and the directory<br />
domains that store the information.<br />
As shown in the following illustration, <strong>Open</strong> <strong>Directory</strong> provides directory services for<br />
<strong>Mac</strong> <strong>OS</strong> X and <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>.<br />
Groups<br />
Users<br />
Printers<br />
Computers<br />
Mounts<br />
<strong>Directory</strong><br />
domains<br />
<strong>Open</strong><br />
<strong>Directory</strong><br />
Application and<br />
system software<br />
processes<br />
<strong>Open</strong> <strong>Directory</strong> can access information in one or several directory domains. A directory<br />
domain stores information in a specialized database that is optimized to handle many<br />
requests for information and to find and retrieve information quickly.<br />
Processes running on <strong>Mac</strong> <strong>OS</strong> X computers can use <strong>Open</strong> <strong>Directory</strong> services to save<br />
information in directory domains. For example, when you create a user account with<br />
Workgroup Manager, it has <strong>Open</strong> <strong>Directory</strong> store user name and other account<br />
information in a directory domain. You can then review user account information in<br />
Workgroup Manager, which uses <strong>Open</strong> <strong>Directory</strong> to retrieve the user information from<br />
a directory domain.<br />
20 Chapter 1 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong>
Other application and system software processes can also use the user account<br />
information stored in directory domains. When someone attempts to log in to a<br />
<strong>Mac</strong> <strong>OS</strong> X computer, the login process uses <strong>Open</strong> <strong>Directory</strong> services to validate the user<br />
name and password:<br />
<strong>Directory</strong><br />
domain<br />
Workgroup Manager<br />
<strong>Open</strong><br />
<strong>Directory</strong><br />
A Historical Perspective<br />
Like <strong>Mac</strong> <strong>OS</strong> X, <strong>Open</strong> <strong>Directory</strong> has a UNIX heritage. <strong>Open</strong> <strong>Directory</strong> provides access to<br />
administrative data that UNIX systems have generally kept in configuration files, which<br />
require painstaking work to maintain. (Some UNIX systems still rely on configuration<br />
files.) <strong>Open</strong> <strong>Directory</strong> consolidates the data and distributes it for ease of access and<br />
maintenance.<br />
Data Consolidation<br />
For years, UNIX systems have stored administrative information in a collection of files<br />
located in the /etc directory, as show in the following illustration.<br />
/etc/group<br />
/etc/hosts<br />
UNIX processes<br />
/etc/master.passwd<br />
This scheme requires each UNIX computer to have its own set of files, and processes<br />
that are running on a UNIX computer read its files when they need administrative<br />
information.<br />
Chapter 1 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong> 21
If you’re experienced with UNIX, you probably know about the files in the /etc<br />
directory—group, hosts, hosts.equiv, master.passwd, and so forth. For example,<br />
a UNIX process that needs a user’s password consults the /etc/master.passwd file.<br />
The /etc/master.passwd file contains a record for each user account. A UNIX process<br />
that needs group information consults the /etc/group file.<br />
<strong>Open</strong> <strong>Directory</strong> consolidates administrative information, simplifying the interactions<br />
between processes and the administrative data they create and use:<br />
<strong>Open</strong><br />
<strong>Directory</strong><br />
<strong>Mac</strong> <strong>OS</strong> X processes<br />
Processes no longer need to know how and where administrative data is stored. <strong>Open</strong><br />
<strong>Directory</strong> gets the data for them. If a process needs the location of a user’s home folder,<br />
the process has <strong>Open</strong> <strong>Directory</strong> retrieve the information. <strong>Open</strong> <strong>Directory</strong> finds the<br />
requested information and then returns it, insulating the process from the details of<br />
how the information is stored, as shown in the following illustration.<br />
<strong>Directory</strong><br />
domain<br />
<strong>Directory</strong><br />
domain<br />
<strong>Open</strong><br />
<strong>Directory</strong><br />
<strong>Mac</strong> <strong>OS</strong> X processes<br />
If you set up <strong>Open</strong> <strong>Directory</strong> to access administrative data from more than one<br />
directory domain, <strong>Open</strong> <strong>Directory</strong> consults them as needed.<br />
Some data stored in a directory domain is identical to data stored in UNIX<br />
configuration files. For example, the home folder location, real name, user ID, and<br />
group ID are stored in the user records of a directory domain instead of the standard<br />
/etc/passwd file.<br />
22 Chapter 1 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong>
However, a directory domain stores much more data to support functions that are<br />
unique to <strong>Mac</strong> <strong>OS</strong> X, such as support for managing <strong>Mac</strong> <strong>OS</strong> X client computers.<br />
Data Distribution<br />
A characteristic of UNIX configuration files is that the administrative data they contain<br />
is available only to the computer they are stored on. Each computer has its own UNIX<br />
configuration files.<br />
With UNIX configuration files, each computer that someone wants to use must have<br />
that person’s user account settings stored on it, and each computer must store the<br />
account settings for every person who can use the computer. To set up a computer’s<br />
network settings, the administrator must to go to the computer and enter the IP<br />
address and other information that identifies the computer on the network.<br />
Similarly, when user or network information must be changed in UNIX configuration<br />
files, the administrator must make the changes on the computer where the files reside.<br />
Some changes, such as network settings, require the administrator to make the same<br />
changes on multiple computers. This approach becomes unwieldy as networks grow in<br />
size and complexity.<br />
<strong>Open</strong> <strong>Directory</strong> solves this problem by letting you store administrative data in a<br />
directory domain that can be managed by a network administrator from one location.<br />
<strong>Open</strong> <strong>Directory</strong> lets you distribute the information so it is visible on a network to the<br />
computers that need it and the administrator who manages it, as shown in the<br />
following illustration.<br />
<strong>Directory</strong><br />
domain<br />
System<br />
administrator<br />
<strong>Open</strong><br />
<strong>Directory</strong><br />
Users<br />
Chapter 1 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong> 23
Uses of <strong>Directory</strong> Data<br />
<strong>Open</strong> <strong>Directory</strong> makes it possible to consolidate and maintain network information<br />
easily in a directory domain, but this information has value only if application and<br />
system software processes running on network computers access the information.<br />
Here are some ways in which <strong>Mac</strong> <strong>OS</strong> X system and application software use directory<br />
data:<br />
 Login: Workgroup Manager can create user records in a directory domain, and these<br />
records can be used to authenticate users who log in to <strong>Mac</strong> <strong>OS</strong> X computers and<br />
Windows computers. When a user specifies a name and a password in the <strong>Mac</strong> <strong>OS</strong> X<br />
login window, the login process asks <strong>Open</strong> <strong>Directory</strong> to authenticate the name and<br />
password. <strong>Open</strong> <strong>Directory</strong> uses the name to find the user’s account record in a<br />
directory domain and uses other data in the user record to validate the password.<br />
 Folder and file access: After logging in, a user can access files and folders. <strong>Mac</strong> <strong>OS</strong> X<br />
uses other data from the user record to determine the user’s access privileges for<br />
each file or folder.<br />
 Home folders: Each user record in a directory domain stores the location of the<br />
user’s home folder. This is where the user keeps personal files, folders, and<br />
preferences. A user’s home folder can be located on a computer the user always uses<br />
or it can be located on a network file server.<br />
 Automount share points: Share points can be configured to automount (appear<br />
automatically) in the /Network folder (the Network globe) in the Finder windows of<br />
client computers. Information about these automount share points is stored in a<br />
directory domain. Share points are folders, disks, or disk partitions you have made<br />
accessible over the network.<br />
 Mail account settings: Each user’s record in a directory domain specifies whether<br />
the user has mail service, which mail protocols to use, how to present incoming mail,<br />
whether to alert the user when mail arrives, and so forth.<br />
 Resource usage: Disk, print, and mail quotas can be stored in each user record of a<br />
directory domain.<br />
 Managed client information: The administrator can manage the <strong>Mac</strong> <strong>OS</strong> X<br />
environment of users whose account records are stored in a directory domain.<br />
The administrator makes mandatory preference settings that are stored in the<br />
directory domain and override users’ personal preferences.<br />
 Group management: In addition to user records, a directory domain also stores<br />
group records. Each group record affects all users who are in the group. Information<br />
in group records specifies preference settings for group members. Group records also<br />
determine access to files, folders, and computers.<br />
24 Chapter 1 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong>
 Managed network views: The administrator can set up custom views that users see<br />
when they select the Network icon in the sidebar of a Finder window. Because these<br />
managed network views are stored in a directory domain, they’re available<br />
automatically when a user logs in.<br />
Access to <strong>Directory</strong> Services<br />
<strong>Open</strong> <strong>Directory</strong> can access directory domains for the following kinds of directory<br />
services:<br />
 Lightweight <strong>Directory</strong> Access Protocol (LDAP), an open standard common in mixed<br />
environments of <strong>Mac</strong>intosh, UNIX, and Windows systems. LDAP is the native<br />
directory service for shared directories in <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>.<br />
 Local directory domain, the local directory service for every <strong>Mac</strong> <strong>OS</strong> X and <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> version 10.5 or later.<br />
 Active <strong>Directory</strong>, the directory service of Microsoft Windows 2000 and 2003 servers.<br />
 Network Information System (NIS), the directory service of many UNIX servers.<br />
 BSD flat files, the legacy directory service of UNIX systems.<br />
Inside a <strong>Directory</strong> Domain<br />
Information in a directory domain is organized by record type. Record types are specific<br />
categories of information, such as users, groups, and computers. For each record type, a<br />
directory domain can contain any number of records. Each record is a collection of<br />
attributes, and each attribute has one or more values.<br />
If you think of each record type as a spreadsheet that contains a category of<br />
information, then records are like the rows of the spreadsheet, attributes are like<br />
spreadsheet columns, and each spreadsheet cell contains one or more values.<br />
For example, when you define a user account by using Workgroup Manager, you are<br />
creating a user record (a record of the “user” record type). The settings you configure<br />
for the user account—short name, full name, home folder location, and so on—<br />
become values of attributes in the user record. The user record and the values of its<br />
attributes reside in a directory domain.<br />
In some directory services, such as LDAP and Active <strong>Directory</strong>, directory information is<br />
organized by object class. Like record types, object classes define categories of<br />
information. An object class defines similar information, named entries, by specifying<br />
attributes that an entry must or may contain.<br />
For an object class, a directory domain can contain multiple entries, and each entry can<br />
contain multiple attributes. Some attributes have a single value, while others have<br />
multiple values. For example, the inetOrgPerson object class defines entries that<br />
contain user attributes.<br />
Chapter 1 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong> 25
The inetOrgPerson class is a standard LDAP class defined by RFC 2798. Other standard<br />
LDAP object classes and attributes are defined by RFC 2307. <strong>Open</strong> <strong>Directory</strong>’s default<br />
object classes and attributes are based on these RFCs.<br />
A collection of attributes and record types or object classes provides a blueprint for the<br />
information in a directory domain. This blueprint is named the schema of the directory<br />
domain. However, <strong>Open</strong> <strong>Directory</strong> uses a directory-based schema that is different from<br />
a locally based stored schema.<br />
The challenge of using a locally based schema configuration file, with an <strong>Open</strong><br />
<strong>Directory</strong> master that services replica servers, is that if you change or add an attribute<br />
to the locally based schema of a <strong>Open</strong> <strong>Directory</strong> master you must also make that<br />
change to each replica. Depending on the number of replicas you have, the manual<br />
update process might take an enormous amount of time.<br />
If you don’t make the same schema change locally on each replica, your replica servers<br />
will generate errors and fail when values for the newly added attribute are sent to the<br />
replica servers.<br />
To eliminate this possibility of failure <strong>Mac</strong> <strong>OS</strong> X uses a directory-based schema that is<br />
stored in the directory database and is automatically updated for each replica server<br />
from the replicated directory database. This keeps the schema for all replicas<br />
synchronized and provides greater flexibility to make changes to the schema.<br />
26 Chapter 1 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong>
Structure of LDAP <strong>Directory</strong> Information<br />
In an LDAP directory, entries are arranged in a hierarchical treelike structure. In some<br />
LDAP directories, this structure is based on geographic and organizational boundaries.<br />
More commonly, the structure is based on Internet domain names.<br />
In a simple directory organization, entries representing users, groups, computers, and<br />
other object classes are immediately below the root level of the hierarchy, as shown<br />
here:<br />
dc=com<br />
dc=example<br />
cn=users cn=groups cn=computers<br />
uid=anne<br />
cn=Anne Johnson<br />
uid=juan<br />
cn=Juan Chavez<br />
An entry is referenced by its distinguished name (DN), which is constructed by taking<br />
the name of the entry, referred to as the relative distinguished name (RDN), and<br />
concatenating the names of its ancestor entries. For example, the entry for Anne<br />
Johnson could have an RDN of uid=anne and a DN of uid=anne, cn=users,<br />
dc=example, dc=com.<br />
The LDAP service retrieves data by searching the hierarchy of entries. The search can<br />
begin at any entry. The entry where the search begins is the search base.<br />
You can specify a search base by giving the distinguished name of an entry in the LDAP<br />
directory. For example, the search base cn=users, dc=example, dc=com specifies that<br />
the LDAP service begin searching at the entry whose cn attribute has a value of “users.”<br />
You can also specify how much of the LDAP hierarchy to search below the search base.<br />
The search scope can include all subtrees below the search base or the first level of<br />
entries below the search base. If you use command-line tools to search an LDAP<br />
directory, you can also restrict the search scope to include only the search base entry.<br />
Chapter 1 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong> 27
Local and Shared <strong>Directory</strong> Domains<br />
Where you store your server’s user information and other administrative data is<br />
determined by whether the data must be shared. This information can be stored in the<br />
server’s local directory domain or in a shared directory domain.<br />
About the Local <strong>Directory</strong> Domain<br />
Every <strong>Mac</strong> <strong>OS</strong> X computer has a local directory domain. A local directory domain’s<br />
administrative data is visible only to applications and system software running on the<br />
computer where the domain resides. It is the first domain consulted when a user logs<br />
in or performs some other operation that requires data stored in a directory domain.<br />
When the user logs in to a <strong>Mac</strong> <strong>OS</strong> X computer, <strong>Open</strong> <strong>Directory</strong> searches the<br />
computer’s local directory domain for the user’s record. If the local directory domain<br />
contains the user’s record (and if the user entered the correct password), the login<br />
process proceeds and the user gets access to the computer.<br />
After login, the user could choose “Connect to <strong>Server</strong>” from the Go menu and connect<br />
to <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> for file service. In this case, <strong>Open</strong> <strong>Directory</strong> on the server searches<br />
for the user’s record in the server’s local directory domain.<br />
If the server’s local directory domain has a record for the user (and if the user enters the<br />
correct password), the server grants the user access to file services, as shown below:<br />
Log in to<br />
<strong>Mac</strong> <strong>OS</strong> X<br />
Local directory<br />
domain<br />
Connect to <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> for file service<br />
Local directory<br />
domain<br />
When you set up a <strong>Mac</strong> <strong>OS</strong> X computer, its local directory domain is created and<br />
populated with records. For example, a user record is created for the user who<br />
performed the installation. It contains the user name and password entered during<br />
setup, and other information, such as a unique ID for the user and the location of the<br />
user’s home folder.<br />
28 Chapter 1 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong>
About Shared <strong>Directory</strong> Domains<br />
Although <strong>Open</strong> <strong>Directory</strong> on any <strong>Mac</strong> <strong>OS</strong> X computer can store administrative data in<br />
the computer’s local directory domain, the real power of <strong>Open</strong> <strong>Directory</strong> is that it lets<br />
multiple <strong>Mac</strong> <strong>OS</strong> X computers share administrative data by storing the data in shared<br />
directory domains.<br />
When a computer is configured to use a shared domain, administrative data in the<br />
shared domain is also visible to applications and system software running on that<br />
computer.<br />
If <strong>Open</strong> <strong>Directory</strong> does not find a user’s record in the local directory domain of a<br />
<strong>Mac</strong> <strong>OS</strong> X computer, <strong>Open</strong> <strong>Directory</strong> can search for the user’s record in any shared<br />
domains the computer has access to.<br />
In the following example, the user can access both computers because the shared<br />
domain accessible from both computers contains a record for the user.<br />
Shared<br />
directory<br />
domain<br />
Log in to<br />
<strong>Mac</strong> <strong>OS</strong> X<br />
Local directory<br />
domain<br />
Connect to <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> for file service<br />
Local directory<br />
domain<br />
Shared domains generally reside on servers because directory domains store extremely<br />
important data, such as the data for authenticating users.<br />
Access to servers is usually tightly restricted to protect the data on them. In addition,<br />
directory data must always be available. <strong>Server</strong>s often have extra hardware features<br />
that enhance their reliability, and servers can be connected to uninterruptible power<br />
sources.<br />
Chapter 1 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong> 29
Shared Data in Existing <strong>Directory</strong> Domains<br />
Some organizations—such as universities and worldwide corporations—maintain user<br />
information and other administrative data in directory domains on UNIX or Windows<br />
servers. <strong>Open</strong> <strong>Directory</strong> can search these non-<strong>Apple</strong> domains and shared <strong>Open</strong><br />
<strong>Directory</strong> domains of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> systems, as shown in the illustration below.<br />
Local<br />
directory<br />
domain<br />
Shared<br />
directory<br />
domain<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
Windows server<br />
Active<br />
<strong>Directory</strong><br />
domain<br />
Local<br />
directory<br />
domain<br />
<strong>Mac</strong> <strong>OS</strong> X user <strong>Mac</strong> <strong>OS</strong> X user Windows user<br />
The order in which <strong>Mac</strong> <strong>OS</strong> X searches directory domains is configurable.<br />
A search policy determines the order in which <strong>Mac</strong> <strong>OS</strong> X searches directory domains.<br />
Search policies are explained in Chapter 2, “<strong>Open</strong> <strong>Directory</strong> Search Policies.”<br />
SMB Services and <strong>Open</strong> <strong>Directory</strong><br />
You can configure your <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> with <strong>Open</strong> <strong>Directory</strong> and SMB services to serve<br />
Windows based workstations. Using these to services together, you can configure your<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to be a primary domain controller (PDC) or a backup domain<br />
controller (BDC).<br />
30 Chapter 1 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong>
<strong>Open</strong> <strong>Directory</strong> as a Primary Domain Controller<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> can be configured to serve as a Windows PDC, which enables users of<br />
Windows NT-compatible workstations to log in using domain accounts. A PDC gives<br />
each Windows user one user name and password for logging in from any Windows NT<br />
4.x, Windows 2000, Windows XP, and Windows Vista workstation on the network. Then,<br />
instead of logging in with a user name and password that are defined locally on a<br />
workstation, each user can log in with the user name and password that are defined on<br />
the PDC.<br />
The same user account that can be used for logging in from a Windows workstation<br />
can also be used for logging in from a <strong>Mac</strong> <strong>OS</strong> X computer. Therefore, someone who<br />
uses both platforms can have the same home folder, mail account, and print quotas on<br />
both platforms. Users can change their passwords while logging in to the Windows<br />
domain.<br />
User accounts are stored in the server’s LDAP directory with group, computer, and<br />
other information. The PDC has access to this directory information because you set up<br />
the PDC on a server that is an <strong>Open</strong> <strong>Directory</strong> master, which hosts an LDAP directory.<br />
Further, the PDC uses the <strong>Open</strong> <strong>Directory</strong> master’s Password <strong>Server</strong> to authenticate<br />
users when they log in to the Windows domain. The Password <strong>Server</strong> can validate<br />
passwords using NTLMv2, NTLMv1, LAN Manager, and other authentication methods.<br />
The <strong>Open</strong> <strong>Directory</strong> master can also have a Kerberos Key Distribution Center (KDC). The<br />
PDC doesn’t use Kerberos to authenticate users for Windows services, but mail and<br />
other services can be configured to use Kerberos to authenticate Windows workstation<br />
users who have accounts in the LDAP directory.<br />
To have its password validated by the <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> and Kerberos, a<br />
user account must have a password type of <strong>Open</strong> <strong>Directory</strong>. A user account with a<br />
password type of crypt password can’t be used for Windows services because a crypt<br />
password isn’t validated using the NTLMv2, NTLMv1, or LAN Manager authentication<br />
methods.<br />
The server can also have user accounts in its local directory domain. Every <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> has one. The PDC doesn’t use these accounts for Windows domain login, but the<br />
PDC can use these accounts to authenticate users for Windows file service and other<br />
services.<br />
User accounts in the local directory domain that have a password type of shadow<br />
password can be used for Windows services because a shadow password can be<br />
validated using NTLMv2, NTLMv1, LAN Manager, and other authentication methods.<br />
Chapter 1 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong> 31
For compatibility, <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> supports user accounts that were configured to use<br />
the legacy Authentication Manager technology for password validation in <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> versions 10.0–10.2. After upgrading a server to <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> version 10.5,<br />
existing users can continue to use their same passwords.<br />
A user account uses Authentication Manager if the account is in a local directory<br />
domain that Authentication Manager has been enabled for, and if the account is set to<br />
use a crypt password.<br />
If you migrate a directory from NetInfo to LDAP, all user accounts that used<br />
Authentication Manager for password validation are converted to have a password<br />
type of <strong>Open</strong> <strong>Directory</strong>.<br />
When setting up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> as a PDC, make sure your network doesn’t have<br />
another PDC with the same domain name. The network can have multiple <strong>Open</strong><br />
<strong>Directory</strong> masters, but it can have only one PDC.<br />
<strong>Open</strong> <strong>Directory</strong> as a BDC<br />
Setting <strong>Mac</strong> <strong>OS</strong> X as a BDC provides failover and backup for the PDC. The PDC and BDC<br />
share Windows client requests for domain login and other directory and authentication<br />
services. If the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> PDC becomes unavailable, the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> BDC<br />
provides domain login and other directory and authentication services.<br />
The BDC has a synchronized copy of the PDC’s user, group, computer, and other<br />
directory data. The PDC and BDC also have synchronized copies of authentication data.<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> automatically synchronizes the directory and authentication data.<br />
Before setting up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> as a BDC, you must set up the server as an<br />
<strong>Open</strong> <strong>Directory</strong> replica. The BDC uses the read-only LDAP directory, Kerberos KDC,<br />
and Password <strong>Server</strong> of the <strong>Open</strong> <strong>Directory</strong> replica.<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> synchronizes the PDC and BDC by automatically updating the <strong>Open</strong><br />
<strong>Directory</strong> replica with changes made to the <strong>Open</strong> <strong>Directory</strong> master.<br />
You use <strong>Server</strong> Admin after installation to make <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> an <strong>Open</strong> <strong>Directory</strong><br />
replica and BDC. You can set up multiple BDCs, each on a separate <strong>Open</strong> <strong>Directory</strong><br />
replica server.<br />
Important: You must not have duplicate PDCs on a network.<br />
32 Chapter 1 <strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong>
2 <strong>Open</strong><br />
<strong>Directory</strong> Search Policies<br />
2<br />
Each computer has a search policy that specifies directory<br />
domains and the sequence in which <strong>Open</strong> <strong>Directory</strong> searches<br />
them.<br />
Each <strong>Mac</strong> <strong>OS</strong> X computer has a search policy, also commonly referred to as a search<br />
path, that specifies which directory domains <strong>Open</strong> <strong>Directory</strong> can access, such as the<br />
computer’s local directory domain and a particular shared directory.<br />
The search policy also specifies the order in which <strong>Open</strong> <strong>Directory</strong> accesses directory<br />
domains. <strong>Open</strong> <strong>Directory</strong> searches each directory domain and stops searching when it<br />
finds a match. For example, <strong>Open</strong> <strong>Directory</strong> stops searching for a user record when it<br />
finds a record whose user name matches the name it’s looking for.<br />
Search Policy Levels<br />
A search policy can include only the local directory domain, the local directory domain<br />
and a shared directory, or the local directory domain and multiple shared directories.<br />
On a network with a shared directory, several computers generally access the shared<br />
directory. This arrangement can be depicted as a tree-like structure with the shared<br />
directory at the top and local directories at the bottom.<br />
Local <strong>Directory</strong> Domain Search Policy<br />
The simplest search policy consists only of a computer’s local directory domain. In this<br />
case, <strong>Open</strong> <strong>Directory</strong> looks for user information and other administrative data only in<br />
the local directory domain of each computer.<br />
If a server on the network hosts a shared directory, <strong>Open</strong> <strong>Directory</strong> does not look there<br />
for user information or administrative data because the shared directory is not part of<br />
the computer’s search policy.<br />
33
The following illustration shows two computers on a network that only search their<br />
local directory domain for administrative data.<br />
Local directory<br />
domain<br />
Local directory<br />
domain<br />
Search Policy<br />
1<br />
English class computer<br />
Science class computer<br />
Two-Level Search Policies<br />
If one server on the network hosts a shared directory, all computers on the network<br />
can include the shared directory in their search policies. In this case, <strong>Open</strong> <strong>Directory</strong><br />
looks for user information and other administrative data first in the local directory<br />
domain. If <strong>Open</strong> <strong>Directory</strong> doesn’t find the information it needs in the local directory<br />
domain, it looks in the shared directory.<br />
The following illustration shows two computers and a shared directory domain on a<br />
network. The computers are connected to the shared directory domain and have it in<br />
their search policy.<br />
Local directory<br />
domain<br />
Shared directory<br />
domain<br />
Local directory<br />
domain<br />
Search Policy<br />
1<br />
2<br />
English class computer<br />
Science class computer<br />
Here’s a scenario in which a two-level search policy might be used:<br />
Local directory<br />
domain<br />
Shared directory<br />
domain<br />
Local directory<br />
domain<br />
Search Policy<br />
1<br />
2<br />
English class computer<br />
Science class computer<br />
Local directory<br />
domain<br />
Math class computer<br />
34 Chapter 2 <strong>Open</strong> <strong>Directory</strong> Search Policies
Each class (English, math, science) has its own computer. The students in each class are<br />
defined as users in the local domain of that class’s computer. All three of these local<br />
domains have the same shared domain, in which all instructors are defined.<br />
Instructors, as members of the shared domain, can log in to all class computers.<br />
The students in each local domain can log in to only the computer where their local<br />
account resides.<br />
Local domains reside on their respective computers but a shared domain resides on a<br />
server accessible from the local domain’s computer. When an instructor logs in to any<br />
of the three class computers and cannot be found in the local domain, <strong>Open</strong> <strong>Directory</strong><br />
searches the shared domain.<br />
In the following example, there is only one shared domain, but in more complex<br />
networks, there may be more shared domains.<br />
Local<br />
directory<br />
domain<br />
Shared<br />
directory<br />
domain<br />
School <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong><br />
Science class<br />
computer<br />
Local<br />
directory<br />
domain<br />
Local<br />
directory<br />
domain<br />
Local<br />
directory<br />
domain<br />
English class<br />
computer<br />
Math class<br />
computer<br />
Multilevel Search Policies<br />
If more than one server on the network hosts a shared directory, the computers on the<br />
network can include two or more shared directories in their search policies. As with<br />
simpler search policies, <strong>Open</strong> <strong>Directory</strong> always looks for user information and other<br />
administrative data first in the local directory domain. If <strong>Open</strong> <strong>Directory</strong> does not find<br />
the information it needs in the local directory domain, it searches each shared directory<br />
in the sequence specified by the search policy.<br />
Chapter 2 <strong>Open</strong> <strong>Directory</strong> Search Policies 35
Here’s a scenario in which more than one shared directory might be used:<br />
Math directory<br />
domain<br />
Search Policy<br />
1<br />
2<br />
3<br />
English directory<br />
domain<br />
School directory<br />
domain<br />
Science directory<br />
domain<br />
Each class (English, math, science) has a server that hosts a shared directory domain.<br />
Each classroom computer’s search policy specifies the computer’s local domain,<br />
the class’s shared domain, and the school’s shared domain.<br />
The students in each class are defined as users in the shared domain of that class’s<br />
server, so each student can log in to any computer in the class. Because the instructors<br />
are defined in the shared domain of the school server, they can log in to any classroom<br />
computer.<br />
You can affect an entire network or a group of computers by choosing the domain in<br />
which to define administrative data. The higher the administrative data resides in a<br />
search policy, the fewer places it needs to be changed as users and system resources<br />
change.<br />
Probably the most important aspect of directory services for administrators is planning<br />
directory domains and search policies. These should reflect the resources you want to<br />
share, the users you want to share them among, and the way you want to manage your<br />
directory data.<br />
Automatic Search Policies<br />
<strong>Mac</strong> <strong>OS</strong> X computers can be configured to set search policies automatically.<br />
An automatic search policy consists of two parts, one of which is optional:<br />
 Local directory domain<br />
 Shared LDAP directory (optional)<br />
36 Chapter 2 <strong>Open</strong> <strong>Directory</strong> Search Policies
A computer’s automatic search policy always begins with the computer’s local directory<br />
domain. If a <strong>Mac</strong> <strong>OS</strong> X computer is not connected to a network, the computer searches<br />
its local directory domain for user accounts and other administrative data.<br />
The automatic search policy then determines whether the computer is configured to<br />
connect to a shared local directory domain. The computer can be connected to a<br />
shared local directory domain, which can in turn be connected to another shared local<br />
directory domain, and so on.<br />
A local directory domain connection, if any, constitutes the second part of the<br />
automatic search policy. For more information, see “About the Local <strong>Directory</strong> Domain”<br />
on page 28.<br />
Finally, a computer with an automatic search policy can connect to a shared LDAP<br />
directory. When the computer starts, it can get the address of an LDAP directory server<br />
from DHCP service. The DHCP service of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> can supply an LDAP server<br />
address in the same way it supplies the addresses of DNS servers and a router.<br />
(A non-<strong>Apple</strong> DHCP service can also supply an LDAP server address. This feature is<br />
known as DHCP option 95.)<br />
If you want the DHCP service of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to supply clients with an LDAP<br />
server’s address for automatic search policies, configure the LDAP options of DHCP<br />
service. For more information, see the DHCP chapter in Network Services <strong>Administration</strong>.<br />
If you want a <strong>Mac</strong> <strong>OS</strong> X computer to get the address of an LDAP server from DHCP<br />
service:<br />
 The computer must be configured to use an automatic search policy. This includes<br />
selecting the option to add DHCP-supplied LDAP directories. For more information,<br />
see “Using Advanced Search Policy Settings” on page 128 and “Enabling or Disabling<br />
Use of a DHCP-Supplied LDAP <strong>Directory</strong>” on page 134.<br />
 The computer’s network preferences must be configured to use DHCP or DHCP with<br />
manual IP address. <strong>Mac</strong> <strong>OS</strong> X is initially configured to use DHCP. For information<br />
about setting network preferences, search <strong>Mac</strong> Help.<br />
An automatic search policy offers convenience and flexibility, especially for mobile<br />
computers. If a computer with an automatic search policy is disconnected from the<br />
network, connected to a different network, or moved to a different subnet, the<br />
automatic search policy can change.<br />
If the computer is disconnected from the network, it uses its local directory domain.<br />
If the computer is connected to a different network or subnet, it can automatically<br />
change its local directory domain connection and can get an LDAP server address from<br />
the DHCP service on the current subnet.<br />
Chapter 2 <strong>Open</strong> <strong>Directory</strong> Search Policies 37
With an automatic search policy, a computer doesn’t need to be reconfigured to get<br />
directory and authentication services in its new location.<br />
Important: If you configure <strong>Mac</strong> <strong>OS</strong> X to use an automatic authentication search policy<br />
and a DHCP-supplied LDAP server or a DHCP-supplied local directory domain, you<br />
increase the risk of an attacker gaining control of your computer. The risk is higher if<br />
your computer is configured to connect to a wireless network. For more information,<br />
see “Protecting Computers from a Malicious DHCP <strong>Server</strong>” on page 131.<br />
Custom Search Policies<br />
If you don’t want a <strong>Mac</strong> <strong>OS</strong> X computer to use the automatic search policy supplied by<br />
DHCP, you can define a custom search policy for the computer.<br />
For example, a custom search policy could specify that an Active <strong>Directory</strong> domain be<br />
searched before an <strong>Open</strong> <strong>Directory</strong> server’s shared directory domain. Users can<br />
configure their computer to log in using their user records from the Active <strong>Directory</strong><br />
domain and have their preferences managed by group and computer records from the<br />
<strong>Open</strong> <strong>Directory</strong> domain.<br />
A custom search policy generally does not work in multiple network locations or while<br />
not connected to a network because it relies on the availability of specific directory<br />
domains on a particular network.<br />
If a portable computer is disconnected from its usual network, it no longer has access<br />
to the shared directory domains on its custom search policy. However, the<br />
disconnected computer still has access to its own local directory domain because it is<br />
the first directory domain on every search policy.<br />
The portable computer user can log in using a user record from the local directory<br />
domain, which can include mobile user accounts. These mirror user accounts from the<br />
shared directory domain that the portable computer accesses when it’s connected to<br />
its usual network.<br />
Search Policies for Authentication and Contacts<br />
A <strong>Mac</strong> <strong>OS</strong> X computer has a search policy for finding authentication information and it<br />
has a separate search policy for finding contact information:<br />
 <strong>Open</strong> <strong>Directory</strong> uses the authentication search policy to locate and retrieve user<br />
authentication information and other administrative data from directory domains.<br />
 <strong>Open</strong> <strong>Directory</strong> uses the contacts search policy to locate and retrieve name, address,<br />
and other contact information from directory domains. <strong>Mac</strong> <strong>OS</strong> X Address Book uses<br />
this contact information, and other applications can be programmed to use it as well.<br />
Each search policy can be automatic, custom, or local directory domain only.<br />
38 Chapter 2 <strong>Open</strong> <strong>Directory</strong> Search Policies
3 <strong>Open</strong><br />
<strong>Directory</strong> Authentication<br />
3<br />
<strong>Open</strong> <strong>Directory</strong> offers several options for authenticating users<br />
whose accounts are stored in directory domains on <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong>, including Kerberos and the traditional authentication<br />
methods that network services require.<br />
<strong>Open</strong> <strong>Directory</strong> can authenticate users by one or more of the following methods:<br />
 Kerberos authentication for single sign-on<br />
 Traditional authentication methods and a password stored securely in the <strong>Open</strong><br />
<strong>Directory</strong> Password <strong>Server</strong> database<br />
 Traditional authentication methods and a shadow password stored in a secure<br />
shadow password file for each user<br />
 A crypt password stored directly in the user’s account, for backward compatibility<br />
with legacy systems<br />
 A non-<strong>Apple</strong> LDAP server for LDAP bind authentication<br />
In addition, <strong>Open</strong> <strong>Directory</strong> lets you set up a password policy for all users and specific<br />
password policies for each user, such as automatic password expiration and minimum<br />
password length. (Password policies do not apply to administrators, crypt password<br />
authentication, or LDAP bind authentication.)<br />
39
Password Types<br />
Each user account has a password type that determines how the user account is<br />
authenticated. In a local directory domain, the standard password type is shadow<br />
password. On a server upgraded from <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> version 10.3, user accounts in<br />
the local directory domain can also have an <strong>Open</strong> <strong>Directory</strong> password type.<br />
For user accounts in the LDAP directory of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>, the standard password<br />
type is <strong>Open</strong> <strong>Directory</strong>. User accounts in the LDAP directory can also have a password<br />
type of crypt password.<br />
Authentication and Authorization<br />
Services such as the login window and <strong>Apple</strong> file service request user authentication<br />
from <strong>Open</strong> <strong>Directory</strong>. Authentication is part of the process by which a service<br />
determines whether it should grant a user access to a resource. Usually this process<br />
also requires authorization.<br />
Authentication proves a user’s identity, and authorization determines what the<br />
authenticated user is permitted to do. A user typically authenticates by providing a<br />
valid name and password. A service can then authorize the authenticated user to<br />
access specific resources. For example, file service authorizes full access to folders and<br />
files that an authenticated user owns.<br />
You experience authentication and authorization when you use a credit card. The<br />
merchant authenticates you by comparing your signature on the sales slip to the<br />
signature on your credit card. Then the merchant submits your authorized credit card<br />
account number to the bank, which authorizes payment based on your account<br />
balance and credit limit.<br />
<strong>Open</strong> <strong>Directory</strong> authenticates user accounts, and service access control lists (SACLs)<br />
authorize use of services. If <strong>Open</strong> <strong>Directory</strong> authenticates you, the SACL for login<br />
window determines whether you can log in, the SACL for <strong>Apple</strong> Filing Protocol (AFP)<br />
service determines whether you can connect for file service, and so on.<br />
Some services also determine whether a user is authorized to access particular<br />
resources. This authorization can require retrieving other user account information<br />
from the directory domain. For example, AFP service needs the user ID and group<br />
membership information to determine which folders and files the user is authorized<br />
to read and write.<br />
40 Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication
<strong>Open</strong> <strong>Directory</strong> Passwords<br />
When a user’s account has a password type of <strong>Open</strong> <strong>Directory</strong>, the user can be<br />
authenticated by Kerberos or the <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong>. Kerberos is a<br />
network authentication system that uses credentials issued by a trusted server. <strong>Open</strong><br />
<strong>Directory</strong> Password <strong>Server</strong> supports the traditional password authentication methods<br />
that some clients of network services require.<br />
Neither Kerberos nor <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> stores the password in the user’s<br />
account. Both Kerberos and <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> store passwords in secure<br />
databases apart from the directory domain, and passwords can never be read.<br />
Passwords can only be set and verified.<br />
Malicious users might attempt to log in over the network hoping to gain access to<br />
Kerberos and <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong>. <strong>Open</strong> <strong>Directory</strong> logs can alert you to<br />
unsuccessful login attempts. (See “Viewing <strong>Open</strong> <strong>Directory</strong> Status and Logs” on<br />
page 178.)<br />
User accounts in the following directory domains can have <strong>Open</strong> <strong>Directory</strong> passwords:<br />
 The LDAP directory of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
 The local directory domain of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
Note: <strong>Open</strong> <strong>Directory</strong> passwords can’t be used to log in to <strong>Mac</strong> <strong>OS</strong> X version 10.1 or<br />
earlier. Users who log in using the login window of <strong>Mac</strong> <strong>OS</strong> X v10.1 or earlier must be<br />
configured to use crypt passwords. The password type doesn’t matter for other<br />
services. For example, a user of <strong>Mac</strong> <strong>OS</strong> X v10.1 could authenticate for <strong>Apple</strong> file service<br />
with an <strong>Open</strong> <strong>Directory</strong> password.<br />
Shadow Passwords<br />
Shadow passwords support the same traditional authentication methods as <strong>Open</strong><br />
<strong>Directory</strong> Password <strong>Server</strong>. These authentication methods are used to send shadow<br />
passwords over the network in a scrambled form, or hash.<br />
A shadow password is stored as several hashes in a file on the same computer as the<br />
directory domain where the user account resides. Because the password is not stored<br />
in the user account, the password is not easy to capture over the network. Each user’s<br />
shadow password is stored in a different file, named a shadow password file, and these<br />
files are protected so they can be read only by the root user account.<br />
Only user accounts that are stored in a computer’s local directory domain can have a<br />
shadow password. User accounts that are stored in a shared directory can’t have a<br />
shadow password.<br />
Shadow passwords also provide cached authentication for mobile user accounts. For<br />
complete information about mobile user accounts, see User Management.<br />
Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication 41
Crypt Passwords<br />
A crypt password is stored in a hash in the user account. This strategy, historically<br />
named basic authentication, is most compatible with software that needs to access user<br />
records directly. For example, <strong>Mac</strong> <strong>OS</strong> X version 10.1 or earlier expect to find a crypt<br />
password stored in the user account.<br />
Crypt authentication supports a maximum password length of eight bytes (eight ASCII<br />
characters). If a longer password is entered in a user account, only the first eight bytes<br />
are used for crypt password validation. Shadow passwords and <strong>Open</strong> <strong>Directory</strong><br />
passwords are not subject to this length limit.<br />
For secure transmission of passwords over a network, crypt supports the DHX<br />
authentication method.<br />
Providing Secure Authentication for Windows Users<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> also offers the same types of secure passwords for Windows users:<br />
 <strong>Open</strong> <strong>Directory</strong> passwords are required for domain login from a Windows<br />
workstation to a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> PDC and can be used to authenticate for Windows<br />
file service. This type of password can be validated using many authentication<br />
methods, including NTLMv2, NTLMv1, and LAN Manager. <strong>Open</strong> <strong>Directory</strong> passwords<br />
are stored in a secure database, not in user accounts.<br />
 Shadow passwords can’t be used for domain login but they can be used for Windows<br />
file service and other services. This type of password can also be validated using<br />
NTLMv2, NTLMv1, and LAN Manager authentication methods. Shadow passwords are<br />
stored in secure files, not in user accounts.<br />
 A crypt password with Authentication Manager enabled provides compatibility for<br />
user accounts on a server that has been upgraded from <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> version 10.1.<br />
After upgrading the server to <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> version 10.5, these user accounts<br />
should be changed to use <strong>Open</strong> <strong>Directory</strong> passwords, which are more secure than<br />
the legacy Authentication Manager.<br />
42 Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication
Offline Attacks on Passwords<br />
Because crypt passwords are stored in user accounts, they are potentially subject to<br />
attack.<br />
User accounts in a shared directory domain are accessible on the network. Anyone on<br />
the network who has Workgroup Manager or knows how to use command-line tools<br />
can read the contents of user accounts, including crypt passwords stored in them.<br />
<strong>Open</strong> <strong>Directory</strong> passwords and shadow passwords aren’t stored in user accounts, so<br />
these passwords can’t be read from directory domains.<br />
A malicious attacker, or cracker, could use Workgroup Manager or UNIX commands to<br />
copy user records to a file. The cracker can then transport this file to a system and use<br />
various techniques to decode crypt passwords stored in the user records. After<br />
decoding a crypt password, the cracker can log in unnoticed with a legitimate user<br />
name and crypt password.<br />
This form of attack is known as an offline attack because it does not require<br />
successive login attempts to gain access to a system.<br />
An effective way to thwart password cracking is to use good passwords and avoid<br />
using crypt passwords. A password should contain letters, numbers, and symbols in<br />
combinations that can’t be easily guessed by unauthorized users.<br />
Good passwords should not consist of actual words. They can include digits and<br />
symbols (such as # or $), or they can consist of the first letter of all words in a phrase.<br />
Use both uppercase and lowercase letters.<br />
Shadow passwords and <strong>Open</strong> <strong>Directory</strong> passwords are far less susceptible to offline<br />
attack because they are not stored in user records.<br />
Shadow passwords are stored in separate files that can be read only by someone who<br />
knows the password of the root user account (also known as the system<br />
administrator).<br />
<strong>Open</strong> <strong>Directory</strong> passwords are stored securely in the Kerberos KDC and in the <strong>Open</strong><br />
<strong>Directory</strong> Password <strong>Server</strong> database. A user’s <strong>Open</strong> <strong>Directory</strong> password can’t be read<br />
by other users, not even by a user with administrator rights for <strong>Open</strong> <strong>Directory</strong><br />
authentication. (This administrator can change only <strong>Open</strong> <strong>Directory</strong> passwords and<br />
password policies.)<br />
Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication 43
Crypt passwords are not considered secure. They should be used only for user accounts<br />
that must be compatible with UNIX clients that require them, or for <strong>Mac</strong> <strong>OS</strong> X v10.1<br />
clients. Being stored in user accounts, they’re too accessible and therefore subject to<br />
offline attack (see “Offline Attacks on Passwords”). Although stored in an encoded form,<br />
they’re relatively easy to decode.<br />
How Crypt Passwords Are Encrypted<br />
Crypt passwords are not stored in clear text; they are concealed and made unreadable<br />
by encryption. A crypt password is encrypted by supplying the clear text password<br />
with a random number to a mathematical function, known as a one-way hash function.<br />
A one-way hash function always generates the same encrypted value from particular<br />
input but cannot be used to recreate the original password from the encrypted output<br />
it generates.<br />
To validate a password using the encrypted value, <strong>Mac</strong> <strong>OS</strong> X applies the function to the<br />
password entered by the user and compares it with the value stored in the user<br />
account or shadow file. If the values match, the password is considered valid.<br />
Determining Which Authentication Option to Use<br />
To authenticate a user, <strong>Open</strong> <strong>Directory</strong> must determine which authentication option to<br />
use—Kerberos, <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong>, shadow password, or crypt password.<br />
The user’s account contains information that specifies which authentication option to<br />
use. This information is named the authentication authority attribute.<br />
<strong>Open</strong> <strong>Directory</strong> uses the name provided by the user to locate the user’s account in the<br />
directory domain. Then <strong>Open</strong> <strong>Directory</strong> consults the authentication authority attribute<br />
in the user’s account and learns which authentication option to use.<br />
You can change a user’s authentication authority attribute by changing the password<br />
type in the Advanced pane of Workgroup Manager, as shown in the following table. For<br />
more information, see “Changing a User’s Password Type” on page 108.<br />
Password type Authentication authority Attribute in user record<br />
<strong>Open</strong> <strong>Directory</strong><br />
<strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong><br />
and Kerberos 1<br />
Either or both:<br />
 ;<strong>Apple</strong>Password<strong>Server</strong>;<br />
 ;Kerberosv5;<br />
Shadow password<br />
Crypt password<br />
Password file for each user,<br />
readable only by the root user<br />
account<br />
Encoded password in user<br />
record<br />
Either:<br />
 ;ShadowHash; 2<br />
 ;ShadowHash;<br />
Either:<br />
 ;basic;<br />
 no attribute at all<br />
1 User accounts from <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.2 must be reset to include the Kerberos authentication authority<br />
attribute. See “Enabling Single Sign-On Kerberos Authentication for a User” on page 111.<br />
44 Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication
2 If the attribute in the user record is;ShadowHash; without a list of enabled authentication methods, default<br />
authentication methods are enabled. The list of default authentication methods is different for <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
and <strong>Mac</strong> <strong>OS</strong> X.<br />
The authentication authority attribute can specify multiple authentication options. For<br />
example, a user account with an <strong>Open</strong> <strong>Directory</strong> password type normally has an<br />
authentication authority attribute that specifies both Kerberos and <strong>Open</strong> <strong>Directory</strong><br />
Password <strong>Server</strong>.<br />
A user account doesn’t need to include an authentication authority attribute. If a user’s<br />
account contains no authentication authority attribute, <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> assumes a<br />
crypt password is stored in the user’s account. For example, user accounts created<br />
using <strong>Mac</strong> <strong>OS</strong> X version 10.1 or earlier contain a crypt password but not an<br />
authentication authority attribute.<br />
Password Policies<br />
<strong>Open</strong> <strong>Directory</strong> enforces password policies for users whose password type is <strong>Open</strong><br />
<strong>Directory</strong> or shadow password. For example, a user’s password policy can specify a<br />
password expiration interval. If the user is logging in and <strong>Open</strong> <strong>Directory</strong> determines<br />
that the user’s password has expired, the user must replace the expired password. Then<br />
<strong>Open</strong> <strong>Directory</strong> can authenticate the user.<br />
Password policies can disable a user account on a certain date, after a number of days,<br />
after a period of inactivity, or after a number of failed login attempts. Password policies<br />
can also require passwords to be a minimum length, contain at least one letter, contain<br />
at least one numeral, differ from the account name, differ from recent passwords, or be<br />
changed periodically.<br />
The password policy for a mobile user account applies when the account is used while<br />
disconnected from the network and while connected to the network. A mobile user<br />
account’s password policy is cached for use while offline. For more information about<br />
mobile user accounts, see User Management.<br />
Password policies do not affect administrator accounts. Administrators are exempt from<br />
password policies because they can change the policies at will. In addition, enforcing<br />
password policies on administrators could subject them to denial-of-service attacks.<br />
Kerberos and <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> maintain password policies separately.<br />
An <strong>Open</strong> <strong>Directory</strong> server synchronizes the Kerberos password policy rules with <strong>Open</strong><br />
<strong>Directory</strong> Password <strong>Server</strong> password policy rules.<br />
Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication 45
Single Sign-On Authentication<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> uses Kerberos for single sign-on authentication, which relieves users<br />
from entering a name and password separately for every service. With single sign-on, a<br />
user always enters a name and password in the login window. Thereafter, the user does<br />
not need to enter a name and password for <strong>Apple</strong> file service, mail service, or other<br />
services that use Kerberos authentication.<br />
To take advantage of single sign-on, users and services must be Kerberized—configured<br />
for Kerberos authentication—and use the same Kerberos KDC server.<br />
User accounts that reside in an LDAP directory of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> and have a<br />
password type of <strong>Open</strong> <strong>Directory</strong> use the server’s built-in KDC. These user accounts are<br />
automatically configured for Kerberos and single sign-on. The server’s Kerberized<br />
services use the server’s built-in KDC and are configured for single sign-on.<br />
This <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> KDC can also authenticate users for services provided by other<br />
servers. Having more servers with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> use the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> KDC<br />
requires only minimal configuration.<br />
Kerberos Authentication<br />
Kerberos was developed at MIT to provide secure authentication and communication<br />
over open networks like the Internet. It’s named for the three-headed dog that guarded<br />
the entrance to the underworld of Greek mythology.<br />
Kerberos provides proof of identity for two parties. It enables you to prove who you are<br />
to network services you want to use. It also proves to your applications that network<br />
services are genuine, not spoofed.<br />
Like other authentication systems, Kerberos does not provide authorization. Each<br />
network service determines what you are permitted to do based on your proven<br />
identity.<br />
Kerberos permits a client and a server to identify each other much more securely than<br />
typical challenge-response password authentication methods. Kerberos also provides a<br />
single sign-on environment where users authenticate only once a day, week, or other<br />
period of time, thereby easing authentication frequency.<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> offers integrated Kerberos support that virtually anyone can deploy. In<br />
fact, Kerberos deployment is so automatic that users and administrators may not<br />
realize it’s deployed.<br />
<strong>Mac</strong> <strong>OS</strong> X v10.3 and later use Kerberos automatically when someone logs in using an<br />
account set for <strong>Open</strong> <strong>Directory</strong> authentication. It is the default setting for user accounts<br />
in the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> LDAP directory. Other services provided by the LDAP directory<br />
server, such as AFP and mail service, also use Kerberos automatically.<br />
46 Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication
If your network has other servers with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong>, joining them to the<br />
Kerberos server is easy, and most of their services use Kerberos automatically.<br />
Alternatively, if your network has a Kerberos system such as Microsoft Active <strong>Directory</strong>,<br />
you can set up your <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> and <strong>Mac</strong> <strong>OS</strong> X computers to use it for<br />
authentication.<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> and <strong>Mac</strong> <strong>OS</strong> X version 10.3 or later support Kerberos version 5.<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> and <strong>Mac</strong> <strong>OS</strong> X version 10.5 do not support Kerberos version 4.<br />
Breaking the Barriers to Kerberos Deployment<br />
Until recently Kerberos was a technology for universities and government sites. It<br />
wasn’t more widely deployed because adoption barriers needed to be taken down.<br />
<strong>Mac</strong> <strong>OS</strong> X and <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.3 or later eliminate the following historical barriers<br />
to adoption of Kerberos:<br />
 An Administrator had to set up a Kerberos KDC. This was difficult to deploy and<br />
administer.<br />
 There was no standard integration with a directory system. Kerberos only does<br />
authentication. It doesn’t store user account data such as user ID (UID), home folder<br />
location, or group membership. The administrator had to determine how to<br />
integrate Kerberos with a directory system.<br />
 <strong>Server</strong>s had to be registered with the Kerberos KDC. This added an extra step to the<br />
server setup process.<br />
 After setting up a Kerberos server, the administrator had to visit all client<br />
computers and configure each one to use Kerberos. This was time-consuming and<br />
required editing configuration files and using command-line tools.<br />
 You needed a suite of Kerberized applications (server and client software). Some of<br />
the basics were available but porting them and adapting them to work with your<br />
environment was difficult.<br />
 Not all network protocols used for client-server authentication are Kerberosenabled.<br />
Some network protocols still require traditional challenge-response<br />
authentication methods and there is no standard way to integrate Kerberos with<br />
these legacy network authentication methods.<br />
 Kerberos client supports failover so if one KDC is offline it can use a replica, but the<br />
administrator had to figure out how to set up a Kerberos replica.<br />
 <strong>Administration</strong> tools were never integrated. Tools for creating and editing user<br />
accounts in the directory domain didn’t know anything about Kerberos, and the<br />
Kerberos tools knew nothing about user accounts in directories. Setting up a user<br />
record was a site-specific operation based on how the KDC was integrated with the<br />
directory system.<br />
Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication 47
Single Sign-On Experience<br />
Kerberos is a credential or ticket-based system. The user logs in once to the Kerberos<br />
system and is issued a ticket with a life span. During the life span of this ticket the user<br />
doesn’t need to authenticate again to access a Kerberized service.<br />
The user’s Kerberized client software, such as the <strong>Mac</strong> <strong>OS</strong> X Mail application, presents a<br />
valid Kerberos ticket to authenticate the user for a Kerberized service. This provides a<br />
single sign-on experience.<br />
A Kerberos ticket is like a press pass to a jazz festival held at multiple nightclubs over a<br />
three-day weekend. You prove your identity once to get the pass. Until the pass expires,<br />
you can show it at any nightclub to get a ticket for a performance. All participating<br />
nightclubs accept your pass without seeing your proof of identity again.<br />
Secure Authentication<br />
The Internet is inherently insecure, yet few authentication protocols provide real<br />
security. Malicious hackers can use readily available software tools to intercept<br />
passwords being sent over a network.<br />
Many applications send passwords unencrypted, and these are ready to use as soon as<br />
they’re intercepted. Even encrypted passwords are not completely safe. Given enough<br />
time and computing power, encrypted passwords can be cracked.<br />
To isolate passwords on your private network you can use a firewall can be used, but<br />
this does not solve all problems. For example, a firewall does not provide security<br />
against disgruntled or malicious insiders.<br />
Kerberos was designed to solve network security problems. It never transmits the user’s<br />
password across the network, nor does it save the password in the user’s computer<br />
memory or on disk. Therefore, even if the Kerberos credentials are cracked or<br />
compromised, the attacker does not learn the original password, so he or she can<br />
potentially compromise only a small portion of the network.<br />
In addition to superior password management, Kerberos is also mutually authenticated.<br />
The client authenticates to the service, and the service authenticates to the client. A<br />
man-in-the-middle or spoofing attack is impossible when you are using Kerberized<br />
services, and that means users can trust the services they are accessing.<br />
48 Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication
Ready to Move Beyond Passwords<br />
Network authentication is difficult: To deploy a network authentication method both<br />
the client and server must agree on the authentication method. And although it is<br />
possible for client/server processes to agree on a custom authentication method,<br />
getting pervasive adoption across a suite of network protocols, platforms, and clients is<br />
virtually impossible.<br />
For example, suppose you wanted to deploy smart cards as a network authentication<br />
method. Without Kerberos, you’d have to change every client/server protocol to<br />
support the new method. The list of protocols includes SMTP, POP, IMAP, AFP, SMB,<br />
HTTP, FTP, IPP, SSH, QuickTime Streaming, DNS, LDAP, local directory domain, RPC, NFS,<br />
AFS, WebDAV, and LPR, and goes on and on.<br />
Considering all the software that does network authentication, deploying a new<br />
authentication method across the entire suite of network protocols would be a<br />
daunting task. Although this might be feasible for software from one vendor, you’d be<br />
unlikely to get all vendors to change their client software to use your new method.<br />
Furthermore, you’d probably also want your authentication to work on multiple<br />
platforms (such as <strong>Mac</strong> <strong>OS</strong> X, Windows, and UNIX).<br />
Due to the design of Kerberos, a client/server binary/protocol that supports Kerberos<br />
doesn’t even know how the user proves identity. Therefore you only need to change<br />
the Kerberos client and the Kerberos server to accept a new proof of identity such as a<br />
smart card. As a result, your entire Kerberos network has now adopted the new proofof-identity<br />
method, without deploying new versions of client and server software.<br />
Multiplatform Authentication<br />
Kerberos is available on every major platform, including <strong>Mac</strong> <strong>OS</strong> X, Windows, Linux, and<br />
other UNIX variants.<br />
Centralized Authentication<br />
Kerberos provides a central authentication authority for the network. All Kerberosenabled<br />
services and clients use this central authority. Administrators can centrally<br />
audit and control authentication policies and operations.<br />
Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication 49
Kerberized Services<br />
Kerberos can authenticate users for the following services of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>:<br />
 Login window<br />
 Mail service<br />
 AFP file service<br />
 FTP file service<br />
 SMB file service (as a member of an Active <strong>Directory</strong> Kerberos realm)<br />
 VPN service<br />
 Apache web service<br />
 LDAP directory service<br />
 iChat service<br />
 Print service<br />
 NFS file service<br />
 Xgrid<br />
These services have been Kerberized whether they are running or not. Only services<br />
that have been Kerberized can use Kerberos to authenticate a user. <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
includes command-line tools for Kerberizing other services that are compatible with<br />
MIT-based Kerberos. For more information, see the <strong>Open</strong> <strong>Directory</strong> chapter of<br />
Command-Line <strong>Administration</strong>.<br />
Configuring Services for Kerberos After Upgrading<br />
After upgrading to <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> version 10.5, you may need to configure some<br />
services to use single sign-on Kerberos authentication. These services either weren’t<br />
configured to use Kerberos or weren’t included with the earlier version of <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong>.<br />
If this condition exists, a message about it appears when you connect to the server in<br />
<strong>Server</strong> Admin. The message appears in the Overview pane when you select the server<br />
(not a service) in the <strong>Server</strong>s list.<br />
To configure new and upgraded services to use Kerberos:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the upgraded server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click General.<br />
5 Click Kerberize Services, then enter the name and password of an LDAP directory<br />
administrator account.<br />
Services that were already configured to use Kerberos are not affected.<br />
50 Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication
Kerberos Principals and Realms<br />
Kerberized services are configured to authenticate principals who are known to a<br />
particular Kerberos realm. You can think of a realm as a particular Kerberos database or<br />
authentication domain, which contains validation data for users, services, and<br />
sometimes servers, which are all known as principals.<br />
For example, a realm contains principals’ secret keys, which are the result of a one-way<br />
function applied to passwords.<br />
Service principals are generally based on randomly generated secrets rather than<br />
passwords.<br />
Here are examples of realm and principal names. Realm names are capitalized by<br />
convention to distinguish them from DNS domain names:<br />
 Realm: MYREALM.EXAMPLE.COM<br />
 User principal: jsanchez@MYREALM.EXAMPLE.COM<br />
 Service principal: afpserver/somehost.example.com@MYREALM.EXAMPLE.COM<br />
Kerberos Authentication Process<br />
There are several phases to Kerberos authentication. In the first phase, the client<br />
obtains credentials to be used to request access to Kerberized services. In the second<br />
phase, the client requests authentication for a specific service. In the final phase, the<br />
client presents those credentials to the service.<br />
The following illustration summarizes these activities. The service and the client can be<br />
the same entity (such as the login window) or two different entities (such as a mail<br />
client and the mail server).<br />
Key Distribution<br />
Center (KDC)<br />
2<br />
4<br />
3<br />
6<br />
Kerberized<br />
service<br />
1<br />
Client<br />
5<br />
1 The client authenticates to a Kerberos KDC, which interacts with realms to access<br />
authentication data. This is the only step in which passwords and associated password<br />
policy information are be checked.<br />
2 The KDC issues a ticket-granting ticket to the client. The ticket is the credential needed<br />
when the client wants to use Kerberized services and is good for a configurable period<br />
of time, but it can be revoked before expiration. It is cached on the client until it<br />
expires.<br />
Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication 51
3 The client contacts the KDC with the ticket-granting ticket when it wants to use a<br />
Kerberized service.<br />
4 The KDC issues a ticket for that service.<br />
5 The client presents the ticket to the service.<br />
6 The service authenticates the client by verifying that the ticket is valid.<br />
After authenticating the client, the service determines if the client is authorized to use<br />
the service.<br />
Kerberos only authenticates clients; it does not authorize them to use services. For<br />
example, many services use <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>’s service access control lists (SACLs) to<br />
determine whether a client is authorized to use the service.<br />
Kerberos never sends a password or password policy information to a service. After a<br />
ticket-granting ticket is obtained, no password information is provided.<br />
Time is very important with Kerberos. If the client and the KDC are out of sync by more<br />
than a few minutes, the client will fail to achieve authentication with the KDC. The date,<br />
time, and time zone information must be correct on the KDC server and clients, and the<br />
server and clients should all use the same network time service to keep their clocks in<br />
sync.<br />
For more information about Kerberos, go to the MIT Kerberos website at web.mit.edu/<br />
kerberos/www/index.html.<br />
<strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> and Shadow Password<br />
Authentication Methods<br />
For compatibility with various services, <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> can use several authentication<br />
methods to validate <strong>Open</strong> <strong>Directory</strong> passwords and shadow passwords.<br />
For <strong>Open</strong> <strong>Directory</strong> passwords, <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> uses the standard Simple<br />
Authentication and Security Layer (SASL) mechanism to negotiate an authentication<br />
method between a client and a service.<br />
For shadow passwords, the use of SASL depends on the network protocol. The<br />
following authentication methods are supported:<br />
Method Network security Storage security Uses<br />
APOP<br />
Encrypted, with clear Clear text<br />
POP mail service<br />
text fallback<br />
CRAM-MD5<br />
Encrypted, with clear<br />
text fallback<br />
Encrypted<br />
IMAP mail service, LDAP<br />
service<br />
52 Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication
Method Network security Storage security Uses<br />
DHX Encrypted Encrypted AFP file service, <strong>Open</strong><br />
<strong>Directory</strong><br />
administration<br />
Digest-MD5 Encrypted Encrypted Login window, mail<br />
service<br />
MS-CHAPv2 Encrypted Encrypted VPN service<br />
NTLMv1 and NTLMv2 Encrypted Encrypted SMB services (Windows<br />
NT/98 or later)<br />
LAN Manager Encrypted Encrypted SMB services (Windows<br />
95)<br />
WebDAV-Digest Encrypted Clear text WebDAV file service<br />
(iDisk)<br />
<strong>Open</strong> <strong>Directory</strong> supports many authentication methods because each service that<br />
requires authentication uses some methods but not others. For example, File service<br />
uses one set of authentication methods, Web service uses another set of methods, mail<br />
service uses another set, and so on.<br />
Some authentication methods are more secure than others. The more secure methods<br />
use stronger algorithms to encode the information they transmit between client and<br />
server. The more secure authentication methods also store hashes, which can’t easily be<br />
recovered from the server. Less secure methods store a recoverable, clear text<br />
password.<br />
No one—including an administrator and the root user account—can recover<br />
encrypted passwords by reading them from the database. An administrator can use<br />
Workgroup Manager to set a user’s password, but the administrator can’t read a user’s<br />
password.<br />
If you connect <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 or later to a directory domain of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
v10.3 or earlier, users defined in the older directory domain cannot be authenticated<br />
with the NTLMv2 method. This method may be required to securely authenticate some<br />
Windows users for the Windows services of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 or later.<br />
<strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> in <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 or later supports NTLMv2<br />
authentication, but Password <strong>Server</strong> in <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.3 or earlier does not<br />
support NTLMv2.<br />
If you connect <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.3 or later to a directory domain of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
v10.2 or earlier, users defined in the older directory domain cannot be authenticated<br />
with the MS-CHAPv2 method. This method may be required to securely authenticate<br />
users for the VPN service of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.3 or later.<br />
Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication 53
<strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> in <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.3 or later supports<br />
MS-CHAPv2 authentication, but Password <strong>Server</strong> in <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.2 does<br />
not support MS-CHAPv2.<br />
Disabling <strong>Open</strong> <strong>Directory</strong> Authentication Methods<br />
To make <strong>Open</strong> <strong>Directory</strong> password storage on the server more secure, you can<br />
selectively disable authentication methods.<br />
For example, if no clients are going to use Windows services, you can disable the<br />
NTLMv1, NTLMv2, and LAN Manager authentication methods to prevent storing<br />
passwords on the server using these methods. Then someone who gains unauthorized<br />
access to the server’s password database can’t exploit weaknesses in these<br />
authentication methods to crack passwords.<br />
Important: If you disable an authentication method, its hash is removed from the<br />
password database the next time the user authenticates. If you enable an<br />
authentication method that was disabled, every <strong>Open</strong> <strong>Directory</strong> password must be<br />
reset to add the newly enabled method’s hash to the password database. Users can<br />
reset their own passwords, or a directory administrator can do it.<br />
Disabling an authentication method makes the <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong><br />
database more secure if an unauthorized user gains physical access to an <strong>Open</strong><br />
<strong>Directory</strong> server (master or replica) or to media containing a backup of the <strong>Open</strong><br />
<strong>Directory</strong> master.<br />
Someone who gains access to the password database can try to crack a user’s<br />
password by attacking the hash or recoverable text stored in the password database by<br />
any authentication method. Nothing is stored in the password database by a disabled<br />
authentication method, leaving one less avenue of attack open to a cracker who has<br />
physical access to the <strong>Open</strong> <strong>Directory</strong> server or a backup of it.<br />
Some hashes stored in the password database are easier to crack than others.<br />
Recoverable authentication methods store clear (plainly readable) text. Disabling<br />
authentication methods that store clear text or weaker hashes increases password<br />
database security more than disabling methods that store stronger hashes.<br />
If you believe your <strong>Open</strong> <strong>Directory</strong> master, replicas, and backups are secure, select all<br />
authentication methods. If you’re concerned about the physical security of any <strong>Open</strong><br />
<strong>Directory</strong> server or its backup media, disable some methods.<br />
Note: Disabling authentication methods does not increase the security of passwords<br />
while they are transmitted over the network. Only the password database security is<br />
affected. In fact, disabling some authentication methods may require clients to<br />
configure their software to send passwords over the network in clear text, thereby<br />
compromising password security in a different way.<br />
54 Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication
Disabling Shadow Password Authentication Methods<br />
You can selectively disable authentication methods to make passwords stored in<br />
shadow password files more secure. For example, if a user doesn’t use mail service or<br />
web services, you can disable the WebDAV-Digest and APOP methods for the user.<br />
Then someone who gains access to the shadow password files on a server can’t recover<br />
the user’s password.<br />
Important: If you disable a shadow password authentication method, its hash is<br />
removed from a user’s shadow password file the next time the user authenticates. If<br />
you enable an authentication method that was disabled, the newly enabled method’s<br />
hash is added to the user’s shadow password file the next time the user authenticates<br />
for a service that can use a clear text password, such as login window or AFP.<br />
Alternatively, you can reset the user’s password to add the newly enabled method’s<br />
hash. The user can reset the password, or a directory administrator can do it.<br />
Disabling an authentication method makes the shadow password more secure if a<br />
malicious user gains physical access to a server’s shadow password files or to media<br />
containing a backup of the shadow password files. Someone who gains access to the<br />
password files can try to crack a user’s password by attacking the hash or recoverable<br />
text stored by any authentication method.<br />
Nothing is stored by a disabled authentication method, leaving one less avenue of<br />
attack open to a cracker who has physical access to a server’s shadow password files or<br />
a backup of them.<br />
Hashes stored by some authentication methods are easier to crack than others. With<br />
recoverable authentication methods, original clear text password can be reconstructed<br />
from what is stored in the file. Disabling the authentication methods that store<br />
recoverable or weaker hashes increases shadow password file security more than<br />
disabling methods that store stronger hashes.<br />
If you believe a server’s shadow password files and backups are secure, select all<br />
authentication methods. If you’re concerned about the physical security of the server or<br />
its backup media, disable unused methods.<br />
Note: Disabling authentication methods does not increase the security of passwords<br />
while they are transmitted over the network; only the password storage security is<br />
affected. Disabling some authentication methods may require clients to configure their<br />
software to send passwords over the network in clear text, thereby compromising<br />
password security in a different way.<br />
Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication 55
Contents of the <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> Database<br />
<strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> maintains an authentication database separate from<br />
the directory domain. <strong>Open</strong> <strong>Directory</strong> tightly restricts access to the authentication<br />
database.<br />
<strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> stores the following information in its authentication<br />
database for each user account that has a password type of <strong>Open</strong> <strong>Directory</strong>:<br />
 The user’s password ID, a 128-bit value assigned when the password is created. It is<br />
also stored in the user’s record in the directory domain and is used as a key for<br />
finding a user’s record in the <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> database.<br />
 The password, stored in recoverable (clear text) or hashed (encrypted) forms. The<br />
form depends on the authentication method. A recoverable password is stored for<br />
the APOP and WebDAV authentication methods. For all other methods, the record<br />
stores a hashed (encrypted) password. If no authentication method requiring a clear<br />
text password is enabled, the <strong>Open</strong> <strong>Directory</strong> authentication database stores only<br />
hashes of passwords.<br />
 The user’s short name, for use in log messages viewable in <strong>Server</strong> Admin.<br />
 Password policy data.<br />
 Time stamps and other usage information, such as last login time, last failed<br />
validation time, count of failed validations, and replication information.<br />
LDAP Bind Authentication<br />
For user accounts that reside in an LDAP directory on a non-<strong>Apple</strong> server, <strong>Open</strong><br />
<strong>Directory</strong> attempts to use LDAP bind authentication. <strong>Open</strong> <strong>Directory</strong> sends the LDAP<br />
directory server the name and password supplied by the authenticating user. If the<br />
LDAP server finds a matching user record and password, authentication succeeds.<br />
If the LDAP directory service and the client computer’s connection to it are configured<br />
to send clear text passwords over the network, LDAP bind authentication can be<br />
insecure.<br />
<strong>Open</strong> <strong>Directory</strong> tries to use a secure authentication method with the LDAP directory. If<br />
the directory doesn’t support secure LDAP bind and the client’s LDAPv3 connection<br />
permits sending a clear text password, <strong>Open</strong> <strong>Directory</strong> reverts to simple LDAP bind.<br />
To prevent clear text authentication make sure your LDAP servers don’t accept clear<br />
text passwords.<br />
In this case, you can secure simple LDAP bind authentication by setting up access to<br />
the LDAP directory through the Secure Sockets Layer (SSL) protocol. SSL makes access<br />
secure by encrypting all communications with the LDAP directory. For more<br />
information, see “Changing the Security Policy for an LDAP Connection” on page 145<br />
and “Changing the Connection Settings for an LDAP <strong>Directory</strong>” on page 144.<br />
56 Chapter 3 <strong>Open</strong> <strong>Directory</strong> Authentication
4 <strong>Open</strong><br />
<strong>Directory</strong> Planning and<br />
Management Tools<br />
4<br />
This chapter presents guidelines for planning <strong>Open</strong> <strong>Directory</strong><br />
services and describes tools for managing them. Like the<br />
plumbing and wiring in a building, directory services for a<br />
network must be planned in advance, not on an ad hoc basis.<br />
Keeping information in shared directory domains gives you more control over your<br />
network, gives more users access to the information, and makes it easier to maintain<br />
the information. The amount of control and convenience depends on the effort you<br />
put into planning your shared domains.<br />
The goal of directory domain planning is to design the simplest arrangement of shared<br />
domains that gives your <strong>Mac</strong> <strong>OS</strong> X users easy access to the network resources they<br />
need and that minimizes the time you spend maintaining user records and other<br />
administrative data.<br />
57
General Planning Guidelines<br />
If you do not share user and resource information among multiple <strong>Mac</strong> <strong>OS</strong> X<br />
computers, very little directory domain planning is necessary, because everything can<br />
be accessed from a local directory domain.<br />
However, make sure that all individuals who use a particular <strong>Mac</strong> <strong>OS</strong> X computer have<br />
user accounts on that computer. These user accounts reside in the local directory<br />
domain on the computer.<br />
In addition, everyone who needs to use <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>’s file service, mail service, or<br />
other services that require authentication must have a user account in the server’s local<br />
directory domain. With this arrangement, each user has two accounts, one for logging<br />
in to a computer and one for accessing services of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>, as illustrated in the<br />
following figure. The user logs in to the local directory domain of the <strong>Mac</strong> <strong>OS</strong> X<br />
computer then uses a different account to log in to the local directory domain of the<br />
file services server.<br />
Log in to<br />
<strong>Mac</strong> <strong>OS</strong> X<br />
Local directory<br />
domain<br />
Connect to <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> for file service<br />
Local directory<br />
domain<br />
To share information among <strong>Mac</strong> <strong>OS</strong> X computers and servers, you must set up at least<br />
one shared directory domain. With this arrangement, each user needs an account only<br />
in the shared directory domain.<br />
With this one account, the user can log in to <strong>Mac</strong> <strong>OS</strong> X on any computer that’s<br />
configured to access the shared directory domain. The user can also use this same<br />
account to access services of any <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> that’s configured to access the<br />
shared directory domain.<br />
58 Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools
The following figure illustrates a configuration with a shared directory domain.<br />
The figure shows a user logging in to a <strong>Mac</strong> <strong>OS</strong> X computer using a shared directory<br />
domain account. Then the shared directory domain account is also used to access a file<br />
service. When the user attempts to access the file service, file services server accesses<br />
the shared directory domain to verify the user account. Because both the user<br />
computer and file services computer are connected to the shared directory domain,<br />
the user account on the shared directory domain is used to access both a computer<br />
and services without having to have a local account on each computer.<br />
Shared<br />
directory<br />
domain<br />
Log in to<br />
<strong>Mac</strong> <strong>OS</strong> X<br />
Local directory<br />
domain<br />
Connect to <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> for file service<br />
Local directory<br />
domain<br />
In many organizations, a single shared directory domain is adequate. It can handle<br />
hundreds of thousands of users and thousands of computers sharing the same<br />
resources, such as printer queues, share points for home directories, share points for<br />
applications, and share points for documents.<br />
Replicating the shared directory domain can increase the capacity or performance of<br />
the directory system by configuring multiple servers to handle the directory system<br />
load for the network.<br />
Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools 59
Larger, more complex organizations can benefit from extra shared directory domains.<br />
The following figure shows how one such complex organization might organize its<br />
directory domains.<br />
Local<br />
directory<br />
domain<br />
Shared<br />
directory<br />
domain<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
Windows server<br />
Active<br />
<strong>Directory</strong><br />
domain<br />
Local<br />
directory<br />
domain<br />
<strong>Mac</strong> <strong>OS</strong> X user<br />
Windows user<br />
If you have a large organization and you want to increase the performance and<br />
capacity of your network directory domain, you can add multiple directory domains to<br />
your network. Also, by using multiple directory domains you can load balance your<br />
corporate directory domain.<br />
There are different methods of configuring multiple directory domains. By analyzing<br />
your network topology you can determine the best method for your network.<br />
The following are optional configurations of multiple directory domains:<br />
 <strong>Open</strong> <strong>Directory</strong> with a preexisting domain. You can configure a <strong>Mac</strong> <strong>OS</strong> X <strong>Open</strong><br />
<strong>Directory</strong> server on a network that has a preexisting directory domain such as an<br />
Active <strong>Directory</strong> or <strong>Open</strong> <strong>Directory</strong> domain.<br />
For example, if your organization has a preexisting Active <strong>Directory</strong> server that<br />
supports Windows and <strong>Mac</strong> <strong>OS</strong> X client computers you can add a <strong>Mac</strong> <strong>OS</strong> X <strong>Open</strong><br />
<strong>Directory</strong> server to better support your <strong>Mac</strong> users. The two servers can exist on the<br />
same network and provide redundant directory domains for both Windows and<br />
<strong>Mac</strong> <strong>OS</strong> X clients. You also configure the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to handle cross-domain<br />
authorization if a Kerberos realm exists.<br />
If you set up your <strong>Mac</strong> <strong>OS</strong> X server with the workgroup configuration, you can easily<br />
add it to your preexisting directory domain. Using the workgroup configuration of<br />
<strong>Mac</strong> <strong>OS</strong> X you can easily import users from your preexisting directory domain into<br />
your workgroup server. These imported users are referred to as augmented users.<br />
For more information about augmented users and workgroup or standard<br />
configuration of <strong>Mac</strong> <strong>OS</strong> X server, see Getting Started and User Management.<br />
60 Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools
 <strong>Open</strong> <strong>Directory</strong> Master <strong>Server</strong> with replicas. You can also create a <strong>Mac</strong> <strong>OS</strong> X <strong>Open</strong><br />
<strong>Directory</strong> master server with replicas. The replica servers have a copy of the <strong>Open</strong><br />
<strong>Directory</strong> master’s directory domain for load balancing and redundancy.<br />
 For example, your organization could have an <strong>Open</strong> <strong>Directory</strong> master at your<br />
headquarters and place replicas of that server at each remote location. This prevents<br />
users at remote locations from experiencing delayed logins.<br />
 Cascading replication. You can also use cascading replication, where replicas of an<br />
<strong>Open</strong> <strong>Directory</strong> master have replicas. If a replica is a direct member of the <strong>Open</strong><br />
<strong>Directory</strong> master and it has replicas it is called a relay.<br />
For example, If your organization has 32 replicas and you must add another replica,<br />
you can reorganize your network topology and have your replicas become relays by<br />
adding replicas to a replica (or relay).<br />
Cascading replication load balances the <strong>Open</strong> <strong>Directory</strong> master by minimizing the<br />
number of replicas it must directly manage.<br />
Estimating <strong>Directory</strong> and Authentication Requirements<br />
In addition to considering how you want to distribute directory data among multiple<br />
domains, you must also consider the capacity of each directory domain. The size of<br />
your directory domain depends on your network requirements.<br />
One factor is the performance of the database that stores directory information.<br />
The LDAP directory domain of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> uses the Berkeley DB database,<br />
which remains efficient with 200,000 records. A server hosting a directory domain of<br />
that size must have sufficient hard disk space to store all the records.<br />
The number of connections a directory service can handle is harder to measure<br />
because directory service connections occur in the context of the connections of all<br />
services the server provides. With <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>, a server dedicated to <strong>Open</strong><br />
<strong>Directory</strong> has a limit of 1000 simultaneous client computer connections.<br />
The <strong>Open</strong> <strong>Directory</strong> server can provide LDAP and authentication services to more client<br />
computers, because not all computers need these services at the same time. Each<br />
computer connects to the LDAP directory for up to two minutes, and connections to<br />
the <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> are even more brief.<br />
Determining what the fraction is—what percentage of computers will make<br />
connections at the same time—can be difficult.<br />
For example, computers that each have a single user who spends all day working on<br />
graphics files will need <strong>Open</strong> <strong>Directory</strong> services relatively infrequently.<br />
Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools 61
In contrast, computers in a lab will have many users logging in throughout the day,<br />
each with a different set of managed client preference settings, and these computers<br />
will place a relatively high load on <strong>Open</strong> <strong>Directory</strong> services.<br />
In general, you can correlate <strong>Open</strong> <strong>Directory</strong> usage with login and logout. These<br />
activities generally dominate directory and authentication services for any system.<br />
The more frequently users log in and out, the fewer computers an <strong>Open</strong> <strong>Directory</strong><br />
server (or any directory and authentication server) can support. You need more <strong>Open</strong><br />
<strong>Directory</strong> servers if users log in frequently. You can get by with fewer <strong>Open</strong> <strong>Directory</strong><br />
servers if work sessions are long and login is infrequent.<br />
Identifying <strong>Server</strong>s for Hosting Shared Domains<br />
If you need more than one shared domain, identify the servers where the shared<br />
domains should reside. Shared domains affect many users, so they should reside on<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> computers that have the following characteristics:<br />
 Restricted physical access<br />
 Limited network access<br />
 High-availability technologies, such as uninterruptible power supplies<br />
Select computers that will not be replaced frequently and that have adequate capacity<br />
for expanding directory domains. Although you can move a shared domain after it is<br />
set up, it might be necessary to reconfigure the search policies of computers that<br />
connect to the shared domain so users can continue to log in.<br />
Replicating <strong>Open</strong> <strong>Directory</strong> Services<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> supports replication of the LDAP directory service, the <strong>Open</strong> <strong>Directory</strong><br />
Password <strong>Server</strong>, and the Kerberos KDC.<br />
By replicating your directory and authentication services you can:<br />
 Move directory information closer to a population of users in a geographically<br />
distributed network, improving performance of directory and authentication services<br />
to these users.<br />
 Achieve redundancy, so users see little disruption in service if a directory system fails<br />
or becomes unreachable.<br />
One server has a primary copy of the shared LDAP directory domain, <strong>Open</strong> <strong>Directory</strong><br />
Password <strong>Server</strong>, and Kerberos KDC. This server is referred to as an <strong>Open</strong> <strong>Directory</strong><br />
master. Each <strong>Open</strong> <strong>Directory</strong> replica is a separate server with a copy of the master’s<br />
LDAP directory, <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong>, and Kerberos KDC.<br />
A <strong>Mac</strong> <strong>OS</strong> X <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong> can have up to 32 replicas. Each replica can have 32<br />
replicas of itself, providing you with1056 replicas in a two-tier hierarchy.<br />
62 Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools
Access to the LDAP directory on a replica is read only. Changes to user records and<br />
other account information in the LDAP directory can be made only on the <strong>Open</strong><br />
<strong>Directory</strong> master.<br />
The <strong>Open</strong> <strong>Directory</strong> master updates its replicas when there are changes to the LDAP<br />
directory. The master can update replicas every time a change occurs, or you can set up<br />
a schedule so updates occur at regular intervals. The fixed schedule option is best if<br />
replicas are connected to the master by a slow network link.<br />
Passwords and password policies can be changed on any replica. If a user’s password or<br />
password policy are changed on more than one replica, the most recent change<br />
prevails.<br />
The updating of replicas relies on the clocks of the master and replicas being in sync.<br />
If replicas and the master have different times, updating could be arbitrary. The date,<br />
time, and time zone information must be correct on the master and replicas, and they<br />
should use the same network time service to keep their clocks in sync.<br />
Avoid having only one replica on either side of a slow network link. If a replica is<br />
separated from all other replicas by a slow network link and the one replica fails, clients<br />
of the replica will fail over to a replica on the other side of the slow network link. As a<br />
result, their directory services may slow markedly.<br />
If your network has a mix of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> versions 10.4 and 10.5, one version can’t<br />
be a replica of a master of the other version. An <strong>Open</strong> <strong>Directory</strong> master of <strong>v10.5</strong> won’t<br />
replicate to v10.4, nor will an <strong>Open</strong> <strong>Directory</strong> master of v10.4 replicate to <strong>v10.5</strong>:<br />
Replica version <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong> master <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 master<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong> replica Yes No<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 replica No Yes<br />
Replica Sets<br />
A replica set is an automatic configuration that requires each service that <strong>Open</strong><br />
<strong>Directory</strong> manages (LDAP, Password server, and Kerberos) to look for and use the same<br />
replica server. This helps ensure that client computers choose the same replica server<br />
when using <strong>Open</strong> <strong>Directory</strong> services and helps prevent slow login.<br />
Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools 63
Cascading Replication<br />
<strong>Mac</strong> <strong>OS</strong> X v10.4 used a hub-spoke model for replicating <strong>Open</strong> <strong>Directory</strong> master servers.<br />
This required each <strong>Open</strong> <strong>Directory</strong> master to maintain a transaction record for each<br />
replica server.<br />
The following illustration shows the hub-spoke model used for replication in<br />
<strong>Mac</strong> <strong>OS</strong> X v10.4.<br />
Replica<br />
Replica<br />
Replica<br />
<strong>Open</strong> <strong>Directory</strong><br />
Master<br />
Replica<br />
Replica<br />
Replica<br />
In addition, there was no predefined limit to how many replica servers an <strong>Open</strong><br />
<strong>Directory</strong> master could manage.<br />
If an <strong>Open</strong> <strong>Directory</strong> master had 1000 replicas to manage, it could have performance<br />
issues if replicas continued to be added. This is similar to having one manager for 1000<br />
employees, which is an unmanageable situation.<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong> uses cascading replication to improve scalability and resolve<br />
performance issues with the older hub-spoke model of replication. The use of<br />
cascading replication helps limit the number of replica servers that can be supported<br />
by a single <strong>Open</strong> <strong>Directory</strong> master server.<br />
A single <strong>Open</strong> <strong>Directory</strong> master server can have up to 32 replicas and each of those<br />
replicas can have up to 32 replicas, which gives you 1056 replicas of a single <strong>Open</strong><br />
<strong>Directory</strong> master server.<br />
This creates a two-tier hierarchy of replica servers. The first tier of replicas, which are the<br />
direct members of the <strong>Open</strong> <strong>Directory</strong> master, are called relays if they have replicas,<br />
because they relay the data to the second tier of replicas.<br />
Also, cascading replication does not require that a single <strong>Open</strong> <strong>Directory</strong> master server<br />
maintain a transaction record of each replica server. The master server only keeps a<br />
maximum of 32 replica transaction records, which improves performance.<br />
64 Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools
The following illustration shows the two-tier hierarchy of the cascading replication<br />
model.<br />
<strong>Open</strong> <strong>Directory</strong><br />
Master<br />
Relay<br />
(Replica)<br />
Relay<br />
(Replica)<br />
Relay<br />
(Replica)<br />
Relay<br />
(Replica)<br />
Replica<br />
Replica<br />
Replica<br />
Replica<br />
Replica<br />
Replica<br />
Replica<br />
Replica<br />
Planning the Upgrade of Multiple <strong>Open</strong> <strong>Directory</strong> Replicas<br />
If your <strong>Open</strong> <strong>Directory</strong> master manages more than 32 replicas, your organization must<br />
migrate to a cascading replication. The cascading replication model will improve your<br />
<strong>Open</strong> <strong>Directory</strong> server performance.<br />
When planning for your migration consider the locations of your replica servers and<br />
your network topology to help determine how to reorganize your replicas into a<br />
hierarchal structure.<br />
For example, you would not want to have an <strong>Open</strong> <strong>Directory</strong> master on the West coast<br />
replicating out to a replica on the East coast.<br />
Note: If your <strong>Open</strong> <strong>Directory</strong> master has fewer than 32 replicas, a migration is not<br />
necessary.<br />
Load Balancing in Small, Medium, and Large Environments<br />
Do not use service load-balancing software from third parties with <strong>Open</strong> <strong>Directory</strong><br />
servers.<br />
Load-balancing software can cause unpredictable problems for <strong>Open</strong> <strong>Directory</strong><br />
computers. It can interfere with the automatic load balancing and failover behavior of<br />
<strong>Open</strong> <strong>Directory</strong> in <strong>Mac</strong> <strong>OS</strong> X and <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>.<br />
<strong>Mac</strong> <strong>OS</strong> X computers seek the nearest available <strong>Open</strong> <strong>Directory</strong> server—master or<br />
replica. A computer’s nearest <strong>Open</strong> <strong>Directory</strong> master or replica is the one that responds<br />
most quickly to the computer’s request for an <strong>Open</strong> <strong>Directory</strong> connection.<br />
Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools 65
Replication in a Multibuilding Campus<br />
A network that spans multiple buildings may have slower network links between<br />
buildings than the link within each building. The network links between buildings may<br />
also be overloaded.<br />
These conditions can adversely affect the performance of computers that get <strong>Open</strong><br />
<strong>Directory</strong> services from a server in another building. As a result, you may want to set up<br />
an <strong>Open</strong> <strong>Directory</strong> replica in each building.<br />
Depending on need, you may even want to set up an <strong>Open</strong> <strong>Directory</strong> replica on each<br />
floor of a multistory building. Each replica provides efficient directory and<br />
authentication services to client computers in its vicinity. The computers do not need<br />
to make connections with an <strong>Open</strong> <strong>Directory</strong> server across the slow, crowded network<br />
link between buildings.<br />
Having more replicas has a disadvantage. Replicas communicate with each other and<br />
with the master over the network. This network communication overhead increases as<br />
you add replicas. Adding too many replicas can add more network traffic between<br />
buildings in the form of replication updates than it removes in the form of <strong>Open</strong><br />
<strong>Directory</strong> client communications.<br />
When deciding how many replicas to deploy, consider how heavily the computers will<br />
use <strong>Open</strong> <strong>Directory</strong> services. If the computers are relatively light users of <strong>Open</strong><br />
<strong>Directory</strong> services and your buildings are connected by fairly fast network links (such as<br />
100 Mbit/s Ethernet), you probably do not need a replica in each building.<br />
You can reduce the communication overhead between <strong>Open</strong> <strong>Directory</strong> replicas and the<br />
master by scheduling how often the <strong>Open</strong> <strong>Directory</strong> master updates the replicas. You<br />
might not need the replicas updated every time a change occurs in the master.<br />
Scheduling less frequent updates of replicas will improve network performance.<br />
Using an <strong>Open</strong> <strong>Directory</strong> Master, Replica, or Relay with NAT<br />
If your network has an <strong>Open</strong> <strong>Directory</strong> server on the private network side of a network<br />
address translation (NAT) router (or gateway), including the NAT router of <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong>, only computers on the private network side of the NAT router can connect to<br />
the <strong>Open</strong> <strong>Directory</strong> server’s LDAP directory domain.<br />
Computers on the public network side of the NAT router can’t connect to the LDAP<br />
directory domain of an <strong>Open</strong> <strong>Directory</strong> master or replica that’s on the private network<br />
side.<br />
If an <strong>Open</strong> <strong>Directory</strong> server is on the public network side of a NAT router, computers on<br />
the private network and the public network sides of the NAT router can connect to the<br />
<strong>Open</strong> <strong>Directory</strong> server’s LDAP directory.<br />
66 Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools
If your network supports mobile clients such as <strong>Mac</strong>Books that will move between the<br />
private LAN of your NAT gateway and the Internet, you must set up VPN service for<br />
mobile users so they can use a VPN to connect to the private network and the <strong>Open</strong><br />
<strong>Directory</strong> domain.<br />
<strong>Open</strong> <strong>Directory</strong> Master and Replica Compatibility<br />
The <strong>Open</strong> <strong>Directory</strong> master and its replicas must use the same version of <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong>. In addition:<br />
 An <strong>Open</strong> <strong>Directory</strong> master using <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong> won’t replicate to <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> v10.4.<br />
 <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong> can’t be a replica of an <strong>Open</strong> <strong>Directory</strong> master using <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> v10.4.<br />
 An <strong>Open</strong> <strong>Directory</strong> master using <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong> can replicate to an <strong>Open</strong><br />
<strong>Directory</strong> replica using <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong>.<br />
If you have an <strong>Open</strong> <strong>Directory</strong> master and replicas that use <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4,<br />
upgrade them to <strong>v10.5</strong> at the same time. First, upgrade the master; then, upgrade the<br />
replicas. Clients of the master and replicas will continue to receive directory and<br />
authentication services during the upgrade.<br />
While you are upgrading the master, its clients will fail over to the nearest replica. When<br />
you upgrade replicas one at a time, clients will fail back to the upgraded master.<br />
Upgrading an <strong>Open</strong> <strong>Directory</strong> master from <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 to <strong>v10.5</strong> will sever ties<br />
to existing replicas. After upgrading each <strong>Open</strong> <strong>Directory</strong> replica to <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
<strong>v10.5</strong>, it will be a standalone directory service and you’ll need to make it a replica again.<br />
For more information about upgrading to <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong>, see Upgrading and<br />
Migrating.<br />
Mixing Active <strong>Directory</strong> and <strong>Open</strong> <strong>Directory</strong> Master and<br />
Replica Services<br />
There are some special considerations when introducing <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>s into<br />
an Active <strong>Directory</strong> environment. If precautions are not taken, mixed results will occur<br />
on client experience and server functionality.<br />
Also, avoid mixing Authenticated <strong>Directory</strong> Binding and Active <strong>Directory</strong> on the same<br />
client or server. Authenticated binding makes use of Kerberos as does Active <strong>Directory</strong>.<br />
Using both will cause unexpected behavior or nonfunctioning authentication services<br />
unless care is taken as detailed below.<br />
Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools 67
When mixing <strong>Open</strong> <strong>Directory</strong> and Active <strong>Directory</strong>, you will only be able to use<br />
Kerberos credentials from one system or another for single sign-on purposes. You<br />
cannot have users exist in Active <strong>Directory</strong> and <strong>Open</strong> <strong>Directory</strong> and use both Kerberos<br />
credentials to Single Sign-on onto a server that is Kerberized for particular server. In<br />
other words, you cannot sign into Active <strong>Directory</strong> account and expect to use single<br />
sign-on with a server that is part of the <strong>Open</strong> <strong>Directory</strong> Kerberos realm.<br />
Kerberos is used in both Active <strong>Directory</strong> and <strong>Open</strong> <strong>Directory</strong> environments. Kerberos<br />
makes certain assumptions about determining the realm of a particular server when<br />
Kerberos tickets are to be used. The following is an example of mixing an Active<br />
<strong>Directory</strong> kerberos realm with an <strong>Open</strong> <strong>Directory</strong> master kerberos realm:<br />
 Active <strong>Directory</strong> Domain = company.com<br />
 Active <strong>Directory</strong> Kerberos realm = COMPANY.COM<br />
 <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong> master = server1.company.com<br />
 <strong>Open</strong> <strong>Directory</strong> Kerberos realm = SERVER1.COMPANY.COM<br />
When kerberos attempts to obtain a TGS for using LDAP with server1.company.com, it<br />
will request “ldap/server1. company.com@COMPANY.COM” unless domain_realm is<br />
present in the configuration. The “domain_realm” for <strong>Open</strong> <strong>Directory</strong> assumes that all<br />
“.company.com” belongs to “SERVER1.DEMOTREE.COM”. This would prevent all<br />
connectivity to the Active <strong>Directory</strong> domain named “company.com”.<br />
If you wish to mix Authenticated <strong>Directory</strong> Binding and Active <strong>Directory</strong>, then your<br />
Active <strong>Directory</strong> Domain and <strong>Open</strong> <strong>Directory</strong> realms and servers must be in a different<br />
hierarchy. For example:<br />
 Active <strong>Directory</strong> Domain = company.com<br />
 Active <strong>Directory</strong> Kerberos realm = COMPANY.COM<br />
 <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong> master = server1.od.company.com<br />
 <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong> realm = “OD.COMPANY.COM”<br />
Or<br />
 Active <strong>Directory</strong> Domain = ads.company.com<br />
 Active <strong>Directory</strong> Kerberos realm = ADS.COMPANY.COM<br />
 <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong> master = server1.od.company.com<br />
 <strong>Open</strong> <strong>Directory</strong> Kerberos realm = OD.COMPANY.COM<br />
In both examples, a new DNS domain zone needs to be created and both forward and<br />
reverse DNS entries need to exist for the servers so that if an IP address is used for the<br />
<strong>Open</strong> <strong>Directory</strong> server, it will get the name expected. For example, IP address<br />
“server1.od.company.com” = 10.1.1.1, so lookup of 10.1.1.1 should be equal to<br />
“server1.od.company.com”, not “server1.company.com”.<br />
68 Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools
Integrating with Existing <strong>Directory</strong> Domains<br />
If your network already has a directory domain, you can add another directory domain<br />
server to your network that uses your existing directory domain’s database to authorize<br />
users access. This configuration is referred to as cross-domain authorization and<br />
requires that your servers support Kerberos.<br />
If you use cross-domain authorization, one server will be a pseudomaster server and<br />
the other will be a subordinate server. All users will authenticate to the pseudomaster<br />
server using a method of authentication, so if a user authenticates, he or she will<br />
receive a Kerberos ticket. When the user attempts to access a service that is offered by<br />
the subordinate server, the subordinate server accepts and validates the user’s Kerberos<br />
ticket, which was given by the pseudomaster server, to authorize the user.<br />
The Kerberos ticket has Privilege Attribute Certificate (PAC) information, which contains<br />
the user name, user IDs (UIDs), and group membership IDs (GIDs). The subordinate<br />
server uses this information to verify that the user is authorized to use the service,<br />
by comparing the UID or GID to the access control list (ACL) of the service the user is<br />
requesting to access.<br />
Using cross-domain authorization keeps you from needing to create different user<br />
names and passwords for your subordinate directory domain server. You can use the<br />
same user names and passwords from the corporate directory domain along with the<br />
PAC information to authorize user access.<br />
Cross-domain authorization is an ideal configuration if you are not permitted to directly<br />
edit groups in the corporate directory domain.<br />
You can use cross-domain authorization between an Active <strong>Directory</strong> server and a<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>v10.5</strong> <strong>Open</strong> <strong>Directory</strong> server or between two <strong>Mac</strong> <strong>OS</strong> X <strong>v10.5</strong> <strong>Open</strong> <strong>Directory</strong><br />
servers. Cross-domain authorization does not work on a <strong>Mac</strong> <strong>OS</strong> X v10.4 server. To use<br />
PAC information, the pseudomaster server must have a Kerberos realm for the<br />
subordinate server to join.<br />
To become a subordinate for a directory system you must use <strong>Directory</strong> Utility to join<br />
your server to an Active <strong>Directory</strong> or <strong>Open</strong> <strong>Directory</strong> server that has Kerberos<br />
configured and running. Then, using <strong>Server</strong> Admin, you must promote your <strong>Open</strong><br />
<strong>Directory</strong> server to an <strong>Open</strong> <strong>Directory</strong> master. The subordinate server automatically<br />
determines that it is subordinate to an Active <strong>Directory</strong> or <strong>Open</strong> <strong>Directory</strong> server and<br />
configures itself accordingly.<br />
You can also have a replica of your subordinate <strong>Open</strong> <strong>Directory</strong> server. To create a<br />
replica of a subordinate directory server, join your server to the pseudomaster and<br />
subordinate server using <strong>Directory</strong> Utility. Then configure the server to be a replica of<br />
the subordinate server.<br />
Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools 69
If you don’t join the server to both the pseudomaster and subordinate server, it will be<br />
blocked or fail to become a replica.<br />
Integrating Without Schema Changes<br />
<strong>Mac</strong> <strong>OS</strong> X and <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> integrate with most LDAP-based directories without<br />
needing to change the schema of your directory server. However, some record types<br />
may not be recognized or maintained by your server’s directory schema.<br />
When you integrate <strong>Mac</strong> <strong>OS</strong> X computers with your directory server, you might want to<br />
add a new record type or object class to the directory schema to better mange and<br />
support your <strong>Mac</strong> <strong>OS</strong> X client computers.<br />
For example, by default there may not be a Picture record type in your directory<br />
schema for your <strong>Mac</strong> <strong>OS</strong> X users, but you can add it to your directory schema so Picture<br />
records can be stored in the directory database.<br />
If you want to add records or attributes to your directory schema, consult your<br />
directory domain administrator for instructions.<br />
Integrating with Schema Changes<br />
If you are adding <strong>Mac</strong> <strong>OS</strong> X computers to your existing directory domain, you can make<br />
schema changes to your directory domain server to better support <strong>Mac</strong> <strong>OS</strong> X client<br />
computers.<br />
When you add a record type or attribute to your schema, investigate whether you<br />
already have a record type or attribute that can easily map to it in your existing<br />
directory schema. If you don’t have a similar record type or attribute that you can map<br />
to, you can add the record type or attribute to your schema. This is referred to as<br />
extending your schema.<br />
When you extend your schema you might need to change the default Access Control<br />
List (ACL) of specific attributes so computer accounts can read the user properties.<br />
For example, you can configure <strong>Mac</strong> <strong>OS</strong> X to access basic user account information in<br />
an Active <strong>Directory</strong> domain of a Windows 2000 or Windows 2003 or later server.<br />
For more information about extending your schema, see the Appendix, “<strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Directory</strong> Data.”<br />
Avoiding Kerberos Conflicts with Multiple Directories<br />
If you set up an <strong>Open</strong> <strong>Directory</strong> master on a network that has an Active <strong>Directory</strong><br />
domain, your network will have two Kerberos realms: An <strong>Open</strong> <strong>Directory</strong> Kerberos<br />
realm and an Active <strong>Directory</strong> Kerberos realm.<br />
For all practical purposes, other servers on the network can use only one Kerberos<br />
realm. When you set up a file server, mail server, or other server that can use Kerberos<br />
authentication, you must choose one Kerberos realm.<br />
70 Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> must belong to the same Kerberos realm as its client users. The realm<br />
has only one authoritative Kerberos server, which is responsible for all Kerberos<br />
authentication in the realm. The Kerberos server can only authenticate clients and<br />
servers in its realm. The Kerberos server can’t authenticate clients or services that are<br />
part of a different realm.<br />
Only user accounts in the chosen Kerberos realm will have single sign-on abilities. User<br />
accounts in the other realm can still authenticate, but they won’t have single sign-on.<br />
If you’re configuring a server to access multiple directory systems each with a Kerberos<br />
realm, plan carefully for the user accounts that will use Kerberized services. You must<br />
know the intent of having access to two directory services. You must join the server to<br />
the realm whose companion directory domain contains the user accounts that must<br />
use Kerberos and single sign-on.<br />
For example, you might want to configure access to an Active <strong>Directory</strong> realm for its<br />
user records and an <strong>Open</strong> <strong>Directory</strong> LDAP directory for the <strong>Mac</strong> <strong>OS</strong> X records and<br />
attributes that aren’t in Active <strong>Directory</strong>, such as group and computer records.<br />
Other servers could join the Active <strong>Directory</strong> Kerberos realm or the <strong>Open</strong> <strong>Directory</strong><br />
Kerberos realm.<br />
In this case, the other servers should join the Active <strong>Directory</strong> Kerberos realm so the<br />
Active <strong>Directory</strong> user accounts have single sign-on.<br />
If you also have user accounts in the <strong>Open</strong> <strong>Directory</strong> server’s LDAP directory, users can<br />
still authenticate to them, but the <strong>Open</strong> <strong>Directory</strong> user accounts won’t use Kerberos or<br />
have single sign-on. They’ll use <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> authentication<br />
methods.<br />
You could put all <strong>Mac</strong> users in the <strong>Open</strong> <strong>Directory</strong> domain and all Windows users in the<br />
Active <strong>Directory</strong> domain, and they could all authenticate, but only one of the<br />
populations could use Kerberos.<br />
Important: Do not configure an <strong>Open</strong> <strong>Directory</strong> master or replica to also access an<br />
Active <strong>Directory</strong> domain (or any other directory domain with a Kerberos realm). If you<br />
do, the <strong>Open</strong> <strong>Directory</strong> Kerberos realm and the Active <strong>Directory</strong> Kerberos realm will try<br />
to use the same configuration files on the <strong>Open</strong> <strong>Directory</strong> server, which will disrupt<br />
<strong>Open</strong> <strong>Directory</strong> Kerberos authentication.<br />
To avoid a Kerberos configuration file conflict, don’t use an <strong>Open</strong> <strong>Directory</strong> server as a<br />
workstation for managing users in another Kerberos server’s directory domain, such as<br />
an Active <strong>Directory</strong> domain. Instead, use an administrator computer (a <strong>Mac</strong> <strong>OS</strong> X<br />
computer with server administration tools installed) that’s configured to access the<br />
related directory domains.<br />
Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools 71
If you must use an <strong>Open</strong> <strong>Directory</strong> server to manage users in another server’s directory<br />
domain, make sure the other directory domain is not part of the <strong>Open</strong> <strong>Directory</strong><br />
server’s authentication search policy.<br />
To further avoid a Kerberos configuration file conflict, don’t use an <strong>Open</strong> <strong>Directory</strong><br />
server to provide services that access a different Kerberos server’s directory domain.<br />
For example, if you configure AFP file service to access both <strong>Open</strong> <strong>Directory</strong> and Active<br />
<strong>Directory</strong>, don’t use an <strong>Open</strong> <strong>Directory</strong> server to provide the file service. Use another<br />
server and join it to the Kerberos realm of one directory service or the other.<br />
Theoretically, servers or clients can belong to two Kerberos realms, such as an <strong>Open</strong><br />
<strong>Directory</strong> realm and an Active <strong>Directory</strong> realm. Multiple-realm Kerberos authentication<br />
requires very advanced configuration, which includes setting up the Kerberos servers<br />
and clients for cross-realm authentication, and revising Kerberized service software so it<br />
can belong to multiple realms.<br />
Improving Performance and Redundancy<br />
You can improve the performance of <strong>Open</strong> <strong>Directory</strong> services by adding memory to the<br />
server and having it provide fewer services. This strategy also applies to every other<br />
service of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>. The more you can dedicate an individual server to a<br />
particular task, the better its performance will be.<br />
Beyond that general strategy, you can also improve <strong>Open</strong> <strong>Directory</strong> server performance<br />
by assigning the LDAP database to its own disk and the <strong>Open</strong> <strong>Directory</strong> logs to another<br />
disk.<br />
If your network includes replicas of an <strong>Open</strong> <strong>Directory</strong> master, you can improve<br />
network performance by scheduling less-frequent updates of replicas. Updating less<br />
frequently means the replicas have less up-to-date directory data, so you must strike a<br />
balance between higher network performance and less accuracy in your replicas.<br />
For greater redundancy of <strong>Open</strong> <strong>Directory</strong> services, set up extra servers as <strong>Open</strong><br />
<strong>Directory</strong> replicas or use servers with RAID sets.<br />
72 Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools
<strong>Open</strong> <strong>Directory</strong> Security<br />
With <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>, a server with a shared LDAP directory domain also provides<br />
<strong>Open</strong> <strong>Directory</strong> authentication. It is important to protect the authentication data stored<br />
by <strong>Open</strong> <strong>Directory</strong>. This authentication data includes the <strong>Open</strong> <strong>Directory</strong> Password<br />
<strong>Server</strong> database and the Kerberos database, which must also be protected. Therefore,<br />
make sure an <strong>Open</strong> <strong>Directory</strong> master and all <strong>Open</strong> <strong>Directory</strong> replicas are secure by<br />
following these guidelines:<br />
 Physical security of a server that is an <strong>Open</strong> <strong>Directory</strong> master or replica is paramount.<br />
Keep it behind a locked door, and always log it out.<br />
 Secure the media you use to back up an <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> database<br />
and a Kerberos database. Having your <strong>Open</strong> <strong>Directory</strong> servers behind locked doors<br />
won’t protect a backup tape that you leave on your desk.<br />
 Do not use a server that is an <strong>Open</strong> <strong>Directory</strong> master or replica to provide other<br />
services. If you can’t dedicate servers to be <strong>Open</strong> <strong>Directory</strong> master and replicas,<br />
minimize the number of services they provide.<br />
One of the other services could have a security breach that gives someone access to<br />
the Kerberos or <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> databases. Dedicating servers to<br />
provide <strong>Open</strong> <strong>Directory</strong> services is an optimal practice but is not required.<br />
 Set up service access control lists (SACLs) for the login window and secure shell (SSH)<br />
to limit who can log in to an <strong>Open</strong> <strong>Directory</strong> master or replica.<br />
 Avoid using a RAID volume that’s shared with other computers as the startup volume<br />
of a server that is an <strong>Open</strong> <strong>Directory</strong> master or replica. A security breach on one of<br />
the other computers could jeopardize the security of the <strong>Open</strong> <strong>Directory</strong><br />
authentication information.<br />
 Set up IP firewall service to block all ports except those used for the following<br />
directory, authentication, and administration protocols:<br />
 <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> uses ports 106 and 3659.<br />
 The Kerberos KDC uses TCP/UDP port 88, and TCP/UDP port 749 is used for<br />
Kerberos administration.<br />
 The shared LDAP directory uses TCP port 389 for an ordinary connection and TCP<br />
port 636 for an SSL connection.<br />
 When creating an <strong>Open</strong> <strong>Directory</strong> replica, keep port 22 open between the master<br />
and prospective replica. This port is used for secure shell (SSH) data transfer, which<br />
is used to transfer a complete, up-to-date copy of the LDAP database. After initial<br />
replica setup, only the LDAP port (389 or 636) is used for replication.<br />
 Workgroup Manager uses TCP port 311 and 625.<br />
 <strong>Server</strong> Admin uses TCP port 311.<br />
 SMB uses TCP/UDP ports 137, 138, 139, and 445.<br />
 Equip the <strong>Open</strong> <strong>Directory</strong> master computer with an uninterruptible power supply.<br />
Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools 73
In summary, the most secure and best practice is to:<br />
 Dedicate each server that is an <strong>Open</strong> <strong>Directory</strong> master or replica to provide only<br />
<strong>Open</strong> <strong>Directory</strong> services.<br />
 Set up a firewall on these servers to provide only the following: directory access,<br />
authentication, and administration protocols (LDAP, Password <strong>Server</strong>, Kerberos,<br />
Workgroup Manager, and <strong>Server</strong> Manager.)<br />
 Physically secure each <strong>Open</strong> <strong>Directory</strong> server and all backup media used with it.<br />
Replicating directory and authentication data over the network is a minimal security<br />
risk. Password data is securely replicated using random keys negotiated during each<br />
replication session. The authentication portion of replication traffic—the <strong>Open</strong><br />
<strong>Directory</strong> Password <strong>Server</strong> and the Kerberos KDC—is fully encrypted.<br />
For extra security, configure network connections between <strong>Open</strong> <strong>Directory</strong> servers to<br />
use network switches rather than hubs. This isolates authentication replication traffic to<br />
trusted network segments.<br />
Service Access Control Lists (SACLs)<br />
<strong>Mac</strong> <strong>OS</strong> X uses SACLs to authorize user access to a service. SACLs are made up of access<br />
control entries (ACEs) that are used to determine the access privileges a user has to a<br />
service.<br />
You can use SACLs to allow or deny user access to an <strong>Open</strong> <strong>Directory</strong> master or replica<br />
by setting SACLs for the login window and SSH. This restricts access to the service.<br />
You can also use SACLs to set administrator access to <strong>Open</strong> <strong>Directory</strong>. This does not<br />
restrict access to the service; instead, it specifies who can administer or monitor the<br />
service. For more information about setting administrator SACLs, see “Configuring<br />
Service Access Control” on page 175.<br />
SACLs provide you with greater control over specifying the administrators that have<br />
access to monitor and manage the service. Only users and groups listed in an SACL<br />
have access to its corresponding service. For example, if you want to give administrator<br />
access to users or groups for the <strong>Open</strong> <strong>Directory</strong> service on your server, add them to<br />
the <strong>Open</strong> <strong>Directory</strong> SACL as an ACE.<br />
74 Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools
Tiered <strong>Administration</strong><br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> does not use organizational units (OUs) for user or group privileges in<br />
directory services. Privileges are independent of how you organize your directory<br />
database. <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong> uses tiered administration for greater granularity of<br />
user read/write privileges for records in the directory database.<br />
User privileges are controlled by organizing users or groups into an ACL and granting<br />
users read/write privileges to records. The entries of users or groups in ACLs are<br />
referred to as ACEs. By using tiered administration you can easily organize your users<br />
within groups and specify the records a group can administer.<br />
If you use tiered administration, consider the following:<br />
 Who is going to be in the group<br />
 The privileges you want to give each group<br />
 The records you want your group to administer<br />
You can give users or groups full or limited control over domain administration.<br />
When giving limited administrative control, you can choose which users and groups a<br />
user or group can administer. You can also specify the control the user has over those<br />
users and groups. For example, granting a user full control gives that user unrestricted<br />
control of the directory domain.<br />
You can only change a user’s domain privileges for LDAPv3 directory domains.<br />
You can’t change privileges for a local directory domain account or for an account<br />
stored in a non-LDAPv3 directory domain.<br />
Full and limited administrators use Workgroup Manager to administrate and manage<br />
users. For more information, see User Management.<br />
Tools for Managing <strong>Open</strong> <strong>Directory</strong> Services<br />
The <strong>Server</strong> Admin, <strong>Directory</strong> Utility, and Workgroup Manager applications provide a<br />
graphical interface for managing <strong>Open</strong> <strong>Directory</strong> services in <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>. In<br />
addition, you can manage <strong>Open</strong> <strong>Directory</strong> services from the command line by using<br />
Terminal.<br />
All these applications are included with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> and can be installed on<br />
another computer with <strong>Mac</strong> <strong>OS</strong> X <strong>v10.5</strong> or later, making that computer an administrator<br />
computer. For more information about setting up an administrator computer, see the<br />
<strong>Server</strong> <strong>Administration</strong> chapter of Getting Started.<br />
Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools 75
<strong>Server</strong> Admin<br />
The <strong>Server</strong> Admin application provides access to tools you use to set up, manage, and<br />
monitor <strong>Open</strong> <strong>Directory</strong> services and other services. You use <strong>Server</strong> Admin to:<br />
 Set up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> as an <strong>Open</strong> <strong>Directory</strong> master, an <strong>Open</strong> <strong>Directory</strong> replica, a<br />
server that’s connected to a directory system, or a standalone directory service with<br />
only a local directory domain. For more information, see Chapter 5, “Setting Up<br />
<strong>Open</strong> <strong>Directory</strong> Services.”<br />
 Set up more <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> systems to use the Kerberos KDC of an <strong>Open</strong> <strong>Directory</strong><br />
master or replica. For more information, see Chapter 5.<br />
 Configure LDAP options on an <strong>Open</strong> <strong>Directory</strong> master. For more information, see<br />
Chapter 5.<br />
 Configure DHCP service to supply an LDAP server address to <strong>Mac</strong> <strong>OS</strong> X computers<br />
with automatic search policies. For more information, see the DHCP chapter of<br />
Network Services <strong>Administration</strong>.<br />
 Set up password policies that apply to all users who don’t have overriding individual<br />
password policies. For more information, see Chapter 6, “Managing User<br />
Authentication.” (To set up individual password policies, use Workgroup Manager;<br />
see Chapter 6.)<br />
 Monitor <strong>Open</strong> <strong>Directory</strong> services. For more information, see Chapter 9, “Maintaining<br />
<strong>Open</strong> <strong>Directory</strong> Services.”<br />
For basic information about using <strong>Server</strong> Admin, see the <strong>Server</strong> <strong>Administration</strong> chapter<br />
in Getting Started. This chapter explains the following:<br />
 <strong>Open</strong>ing and authenticating in <strong>Server</strong> Admin<br />
 Working with servers<br />
 Administering services<br />
 Controlling access to services<br />
 Using SSL for remote server administration<br />
 Customizing the <strong>Server</strong> Admin environment<br />
<strong>Server</strong> Admin is in /Applications/<strong>Server</strong>/.<br />
76 Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools
<strong>Directory</strong> Utility<br />
<strong>Directory</strong> Utility determines how a <strong>Mac</strong> <strong>OS</strong> X computer uses directory services,<br />
discovers network services, and searches directory services for authentication and<br />
contacts information. You use <strong>Directory</strong> Utility to:<br />
 Configure access to LDAP directories, an Active <strong>Directory</strong> domain, and Network<br />
Information Services (NIS) domain<br />
 Configure data mapping for LDAP directories<br />
 Define policies for searching multiple directory services for authentication and<br />
contact information<br />
 Enable or disable types of directory services and types of network service discovery<br />
<strong>Directory</strong> Utility can connect to other servers on your network so you can configure<br />
them remotely.<br />
For more information about using <strong>Directory</strong> Utility, see Chapter 7, “Managing <strong>Directory</strong><br />
Clients.”<br />
<strong>Directory</strong> Utility is installed on every <strong>Mac</strong> <strong>OS</strong> X computer in /Applications/Utilities/.<br />
Workgroup Manager<br />
The Workgroup Manager application provides comprehensive management of<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> clients. You use Workgroup Manager to:<br />
 Set up and manage user accounts, group accounts, and computer groups. For more<br />
information about managing user authentication, see Chapter 6, “Managing User<br />
Authentication.” For more information about other user, group, and computer<br />
management topics, see User Management.<br />
 Manage share points for file services and user home folders. For more information,<br />
see the chapters on share points and SMB services in File Services <strong>Administration</strong> and<br />
the chapter on home folders in User Management.<br />
 Control what <strong>Mac</strong> <strong>OS</strong> X users see when they select the Network globe in a Finder<br />
sidebar. For more information, see the chapter on managing network views in User<br />
Management.<br />
 View directory entries in raw form by using the Inspector. For more information, see<br />
“Viewing and Editing <strong>Directory</strong> Data” on page 179.<br />
For basic information about using Workgroup Manager, see the chapter on server<br />
administration in Getting Started. This chapter explains the following:<br />
 <strong>Open</strong>ing and authenticating in Workgroup Manager<br />
 Administering accounts<br />
 Customizing the Workgroup Manager environment<br />
Workgroup Manager is installed in /Applications/<strong>Server</strong>/.<br />
Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools 77
Command-Line Tools<br />
A full range of command-line tools is available for administrators who prefer to use<br />
command-driven server administration.<br />
For remote server management, submit commands in a secure shell (SSH) session.<br />
You can enter commands on <strong>Mac</strong> <strong>OS</strong> X servers and computers using the Terminal<br />
application, located in /Applications/Utilities/. For more information, see Command-Line<br />
<strong>Administration</strong>.<br />
78 Chapter 4 <strong>Open</strong> <strong>Directory</strong> Planning and Management Tools
5 Setting<br />
Up<br />
<strong>Open</strong> <strong>Directory</strong> Services<br />
5<br />
<strong>Open</strong> <strong>Directory</strong> services—directory services and<br />
authentication services—are an essential part of a network’s<br />
infrastructure. These services have a significant effect on<br />
other network services and on users. Therefore you must set<br />
up <strong>Open</strong> <strong>Directory</strong> correctly from the beginning.<br />
Setup Overview<br />
Here is a summary of the major tasks you perform to set up <strong>Open</strong> <strong>Directory</strong> services.<br />
For detailed information about each step, see the pages indicated.<br />
Step 1: Before you begin, do some planning<br />
For a list of items to think about before you configure <strong>Open</strong> <strong>Directory</strong> on <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong>, see “Before You Begin” on page 80.<br />
Step 2: Turn on <strong>Open</strong> <strong>Directory</strong> service<br />
Use <strong>Server</strong> Admin to turn the <strong>Open</strong> <strong>Directory</strong> service on. After the service is turned on<br />
you can configure <strong>Open</strong> <strong>Directory</strong> service settings. For more information about turning<br />
on <strong>Open</strong> <strong>Directory</strong> service, see “Turning <strong>Open</strong> <strong>Directory</strong> On” on page 81.<br />
Step 3: Set up a standalone directory service<br />
To set up servers that won’t get authentication and other administrative information<br />
from a directory service, see “Setting Up a Standalone <strong>Directory</strong> Service” on page 81.<br />
Step 4: Set up an <strong>Open</strong> <strong>Directory</strong> master<br />
To set up a server to provide directory and authentication services, see “<strong>Open</strong> <strong>Directory</strong><br />
Master and Replica Compatibility” on page 67 and “Setting Up an <strong>Open</strong> <strong>Directory</strong><br />
Master” on page 83.<br />
Step 5: Set up a Primary Domain Controller<br />
To set up a server to provide directory and authentication services for Windows and<br />
<strong>Mac</strong> <strong>OS</strong> X platforms, see “Setting Up a Primary Domain Controller” on page 85.<br />
79
Step 6: Set up an <strong>Open</strong> <strong>Directory</strong> replica<br />
To set up servers to provide failover directory and authentication services or remote<br />
directory and authentication services for fast client interaction on distributed networks,<br />
see “Setting Up an <strong>Open</strong> <strong>Directory</strong> Replica” on page 88.<br />
Step 7: Set up <strong>Open</strong> <strong>Directory</strong> Relays for Cascading Replication<br />
To set up a server to be a replica or relay of an <strong>Open</strong> <strong>Directory</strong> master so it can provide<br />
directory information and authentication information to computers, see “Setting Up<br />
<strong>Open</strong> <strong>Directory</strong> Relays for Cascading Replication” on page 91.<br />
Step 8: Set up a <strong>Server</strong> as a Backup Domain Controller<br />
To set up servers to provide failover support for your Primary Domain Controller, see<br />
“Setting Up a <strong>Server</strong> as a BDC” on page 91.<br />
Step 9: Set up servers that connect to other directory systems<br />
If you have file servers or other servers that access directory and authentication<br />
services, see “Setting Up a Connection to a <strong>Directory</strong> <strong>Server</strong>” on page 93.<br />
Step 10: Set up single sign-on Kerberos authentication<br />
If you have an <strong>Open</strong> <strong>Directory</strong> master, you can configure other servers to join its<br />
Kerberos realm. If you set up an <strong>Open</strong> <strong>Directory</strong> master without Kerberos, you can set<br />
up Kerberos later. For more information, see “Setting Up Single Sign-On Kerberos<br />
Authentication” on page 97.<br />
Step 11: Set up client computers to connect to directory services<br />
If you have an <strong>Open</strong> <strong>Directory</strong> master, you must configure client computers to access<br />
its directory domain. You can also configure computers to access other directory<br />
services such as Microsoft Active <strong>Directory</strong>. See Chapter 7, “Managing <strong>Directory</strong> Clients.”<br />
and Chapter 8, “Advanced <strong>Directory</strong> Client Settings.”<br />
Step 12: Instruct users how to log in<br />
See “Instructing Users How to Log In” on page 85.<br />
Before You Begin<br />
Before setting up <strong>Open</strong> <strong>Directory</strong> services for the first time:<br />
 Understand the uses of directory data and assess your directory needs.<br />
Identify the services that require data from directory domains and determine which<br />
users need access to those services.<br />
Users whose information can be managed most easily on a server should be defined<br />
in the shared LDAP directory of a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> that is an <strong>Open</strong> <strong>Directory</strong> master.<br />
Some of these users can be defined in directory domains on other servers, such as an<br />
Active <strong>Directory</strong> domain on a Windows server.<br />
These concepts are discussed in Chapter 1, “<strong>Directory</strong> Services with <strong>Open</strong> <strong>Directory</strong>.”<br />
80 Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services
 Assess whether you need more than one shared domain. If so, decide which users<br />
will be defined in each shared domain. For more information, see “Multilevel Search<br />
Policies” on page 35.<br />
 Determine which authentication options users need. For available options, see<br />
Chapter 3, “<strong>Open</strong> <strong>Directory</strong> Authentication.” Decide whether to have replicas of your<br />
<strong>Open</strong> <strong>Directory</strong> master or to have a BDC of your PDC. Chapter 4, “<strong>Open</strong> <strong>Directory</strong><br />
Planning and Management Tools,” provides guidelines.<br />
 Select server administrators carefully. Provide administrator passwords only to people<br />
you trust. Have as few administrators as possible. Don’t delegate administrator access<br />
for minor tasks, such as changing settings in a user record.<br />
<strong>Directory</strong> information vitally affects everyone whose computers use it.<br />
Managing <strong>Open</strong> <strong>Directory</strong> on a Remote <strong>Server</strong><br />
You can install <strong>Server</strong> Admin on a computer with <strong>Mac</strong> <strong>OS</strong> X v10.4 or later and use it to<br />
manage <strong>Open</strong> <strong>Directory</strong> on any server on your local network and beyond. You can also<br />
manage <strong>Open</strong> <strong>Directory</strong> remotely by using command-line tools from a <strong>Mac</strong> <strong>OS</strong> X<br />
computer or a non-<strong>Mac</strong>intosh computer.<br />
For more information, see the <strong>Server</strong> <strong>Administration</strong> chapter of Getting Started.<br />
Turning <strong>Open</strong> <strong>Directory</strong> On<br />
Before you can configure <strong>Open</strong> <strong>Directory</strong> settings, you must turn on <strong>Open</strong> <strong>Directory</strong><br />
service in <strong>Server</strong> Admin.<br />
To turn <strong>Open</strong> <strong>Directory</strong> service on:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click Settings.<br />
3 Click Services.<br />
4 Select the <strong>Open</strong> <strong>Directory</strong> checkbox.<br />
5 Click Save.<br />
Setting Up a Standalone <strong>Directory</strong> Service<br />
Using <strong>Server</strong> Admin, you can set up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to use only the server’s local<br />
directory domain. The server does not provide directory information to other<br />
computers or get directory information from an existing system. (The local directory<br />
domain cannot be shared.)<br />
Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services 81
If you change <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to get directory information only from its local directory<br />
domain, user records and other information that the server retrieved from a shared<br />
directory domain becomes unavailable. The user records and other information in the<br />
shared directory domain are deleted.<br />
Files and folders on the server may become unavailable to users whose accounts are in<br />
the shared directory domain.<br />
If the server was an <strong>Open</strong> <strong>Directory</strong> master and other servers were connected to it, the<br />
following can occur:<br />
 Services can be disrupted on the connected servers when the user accounts and<br />
other information in the shared directory domain become unavailable.<br />
 Users whose accounts are in the shared directory domain may not be able to access<br />
files and folders on the <strong>Open</strong> <strong>Directory</strong> master and on other servers that were<br />
connected to its shared LDAP directory domain.<br />
You can archive a copy of the <strong>Open</strong> <strong>Directory</strong> master’s directory and authentication<br />
data before changing it to an <strong>Open</strong> <strong>Directory</strong> standalone directory service. For more<br />
information, see “Archiving an <strong>Open</strong> <strong>Directory</strong> Master” on page 194.<br />
You can also export users, groups, and computer groups from the <strong>Open</strong> <strong>Directory</strong><br />
master before changing it to a standalone directory service. For more information,<br />
see User Management.<br />
To configure a server to use only its own nonshared local directory domain:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click General.<br />
5 Click Change.<br />
The Service Configuration Assistant opens.<br />
6 Choose Standalone, then click Continue.<br />
7 Confirm the <strong>Open</strong> <strong>Directory</strong> configuration setting, then click Continue.<br />
8 If you are sure that users and services no longer need access to the directory data<br />
stored in the shared directory domain that the server has been hosting or is connected<br />
to, click Close.<br />
82 Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services
Setting Up an <strong>Open</strong> <strong>Directory</strong> Master<br />
Using <strong>Server</strong> Admin, you can set up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to be an <strong>Open</strong> <strong>Directory</strong> master<br />
so it can provide directory information and authentication information to other<br />
systems.<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> provides directory information by hosting a shared LDAP directory<br />
domain. In addition, the server authenticates users whose accounts are stored in the<br />
shared LDAP directory domain.<br />
An <strong>Open</strong> <strong>Directory</strong> master has an <strong>Open</strong> <strong>Directory</strong> password server, which supports all<br />
conventional authentication methods required by <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> services. In<br />
addition, an <strong>Open</strong> <strong>Directory</strong> master can provide Kerberos authentication for single<br />
sign-on.<br />
If you want the <strong>Open</strong> <strong>Directory</strong> master to provide Kerberos authentication for single<br />
sign-on, DNS must be available on the network and must be correctly configured to<br />
resolve the fully qualified DNS name of the <strong>Open</strong> <strong>Directory</strong> master server to its IP<br />
address. DNS must also be configured to resolve the IP address to the server’s fully<br />
qualified DNS name.<br />
Important: If you’re changing an <strong>Open</strong> <strong>Directory</strong> replica to an <strong>Open</strong> <strong>Directory</strong> master,<br />
the procedure you follow depends on whether the replica will replace the master or<br />
become an extra master:<br />
 To promote a replica to replace a nonfunctional master, follow the instructions in<br />
“Promoting an <strong>Open</strong> <strong>Directory</strong> Replica” on page 190 instead of the instructions here.<br />
 To change a replica to an extra master, first decommission the replica as described in<br />
“Decommissioning an <strong>Open</strong> <strong>Directory</strong> Replica” on page 193, then make it a master by<br />
following the steps in this topic.<br />
Note: If <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> was connected to a directory system and you make the server<br />
an <strong>Open</strong> <strong>Directory</strong> master, it remains connected to the other directory system. The<br />
server will search for user records and other information in its shared LDAP directory<br />
domain before searching in other directory systems it is connected to.<br />
To configure a server to be an <strong>Open</strong> <strong>Directory</strong> master:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click General.<br />
If the Role option is set to <strong>Open</strong> <strong>Directory</strong> Replica and you want to make a new <strong>Open</strong><br />
<strong>Directory</strong> master, you must change the server role to Standalone. For more information,<br />
see “Setting Up a Standalone <strong>Directory</strong> Service” on page 81.<br />
Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services 83
If you don’t change an <strong>Open</strong> <strong>Directory</strong> replica to a standalone server before making it a<br />
master, you promote the replica to be a master instead of making a new master. For<br />
more information, see “Promoting an <strong>Open</strong> <strong>Directory</strong> Replica” on page 190.<br />
5 Click Change.<br />
This opens the Service Configuration Assistant.<br />
6 Select <strong>Open</strong> <strong>Directory</strong> Master, then click Continue.<br />
7 Enter the following Master Domain Administrator information, then click Continue.<br />
 Name, Short Name, User ID, Password: You must create a user account for the primary<br />
administrator of the LDAP directory. This account is not a copy of the administrator<br />
account in the server’s local directory domain. Make the names and user ID of the<br />
LDAP directory administrator different from the names and user IDs of user accounts<br />
in the local directory domain. Also, if you want to prevent the directory administrator<br />
account from being listed in the login window, you should assign the directory<br />
administrator account a user ID below 100. Accounts with user IDs below 100 are not<br />
listed in the login window.<br />
Note: If you plan to connect your <strong>Open</strong> <strong>Directory</strong> Master to other directory domains,<br />
pick a unique name and user ID for each domain. Don’t use the suggested diradmin<br />
user ID. Use a name that helps you distinguish the directory domain that the directory<br />
administrator controls.<br />
8 Enter the following Master Domain information, then click Continue:<br />
 Kerberos Realm: This field is preset to be the same as the server’s DNS name,<br />
converted to capital letters. This is the convention for naming a Kerberos realm. You<br />
can enter a different name if necessary.<br />
 Search Base: This field is preset to a search base suffix for the new LDAP directory,<br />
derived from the domain portion of the server’s DNS name. You can enter a different<br />
search base suffix or leave it blank. If you leave this field blank, the LDAP directory’s<br />
default search base suffix is used.<br />
9 Confirm settings, then click Close.<br />
10 Confirm that the <strong>Open</strong> <strong>Directory</strong> master is functioning properly by clicking Overview<br />
(near the top of the <strong>Server</strong> Admin window, with <strong>Open</strong> <strong>Directory</strong> selected in the <strong>Server</strong>s<br />
list).<br />
The status of all items listed in the <strong>Open</strong> <strong>Directory</strong> overview pane should say “Running.”<br />
If Kerberos remains stopped and you want it running, see “If Kerberos Is Stopped on an<br />
<strong>Open</strong> <strong>Directory</strong> Master or Replica” on page 199.<br />
After setting up a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> computer to be an <strong>Open</strong> <strong>Directory</strong> master, you can<br />
change its binding policy, security policy, password policy, replication frequency, and<br />
LDAP protocol options. For more information, see “Setting Options for an <strong>Open</strong><br />
<strong>Directory</strong> <strong>Server</strong>” on page 183.<br />
84 Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services
You can configure other computers with <strong>Mac</strong> <strong>OS</strong> X or <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to access the<br />
server’s shared LDAP directory domain. For more information, see “Using Advanced<br />
LDAP Service Settings” on page 133.<br />
Instructing Users How to Log In<br />
When a <strong>Mac</strong> <strong>OS</strong> X computer is connected to a directory domain and is configured to<br />
display a list of users in the <strong>Mac</strong> <strong>OS</strong> X login window, the list may include “Other.” Tell<br />
users who have never logged in with a network account that they must click Other and<br />
then enter the account name and password.<br />
Users can configure their computers to not display a list of users in the login window.<br />
Users change this setting in the Accounts pane of System Preferences by clicking Login<br />
Options.<br />
You can have a computer’s login window show network users in its list, or you can<br />
prevent the list from appearing by managing computer preferences. Use Workgroup<br />
Manager to configure login preference settings for the computer group account that<br />
includes the computer. To manage computers that are not part of a particular<br />
computer group account, configure login preference settings for the Guest Computers<br />
account.<br />
For more information, see User Management.<br />
Setting Up a Primary Domain Controller<br />
Using <strong>Server</strong> Admin, you can set up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> as a Windows primary domain<br />
controller (PDC). The PDC hosts a Windows domain and provides authentication<br />
services to other domain members, including authentication for domain login on<br />
Windows workstations.<br />
If no domain member server is available, the PDC server can provide Windows file and<br />
print services, and it can host user profiles and home folders for users who have user<br />
accounts on the PDC.<br />
Important: When setting up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> as a PDC, make sure your network<br />
doesn’t have another PDC with the same domain name. To set up more domain<br />
controllers, make them backup domain controllers (BDCs).<br />
To set up a Windows PDC:<br />
1 Make sure the server is an <strong>Open</strong> <strong>Directory</strong> master.<br />
To determine whether a server is an <strong>Open</strong> <strong>Directory</strong> master, open <strong>Server</strong> Admin, click<br />
the triangle (to the left of the server), select <strong>Open</strong> <strong>Directory</strong> in the expanded list of<br />
services, then click Overview.<br />
The first line of status information states the role of the <strong>Open</strong> <strong>Directory</strong> server.<br />
Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services 85
2 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
3 Click Settings, then click Services<br />
4 Select the SMB checkbox, then click Save.<br />
5 Click the triangle to left of the server.<br />
The list of services appears.<br />
6 From the <strong>Server</strong>s list, select SMB.<br />
7 Click Settings, then click General.<br />
8 From the Role pop-up menu, choose Primary Domain Controller (PDC), then enter the<br />
following:<br />
 Description: This description appears in the Network Places window on Windows<br />
computers and is optional.<br />
 Computer Name: Enter the name you want Windows users to see when they connect<br />
to the server. This is the server’s NetBI<strong>OS</strong> name. The name should contain no more<br />
than 15 characters, no special characters, and no punctuation. If practical, make the<br />
server name match its unqualified DNS host name. For example, if your DNS server<br />
has an entry for your server as “server.example.com,” give your server the name<br />
“server.”<br />
 Domain: Enter the name of the Windows domain that the server will host. The<br />
domain name cannot exceed 15 characters and cannot be “workgroup.”<br />
9 Click Save.<br />
10 Enter the name and password of an LDAP directory administrator account, then click<br />
OK.<br />
When authenticating, you must use an LDAP directory administrator account. You can’t<br />
use a local administrator account, such as the primary server administrator account<br />
(user ID 501), to create a PDC.<br />
After setting up a PDC, you can change access restrictions, logging detail level, code<br />
page, domain browsing, or WINS registration. Then if Windows services aren’t running,<br />
you can start them. For more information, see Network Services <strong>Administration</strong>.<br />
Setting Up Windows Vista for Domain Login<br />
You can enable domain login on a Windows Vista computer by joining it to the<br />
Windows domain of a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> PDC. Joining the Windows domain requires the<br />
name and password of an LDAP directory administrator account.<br />
You can delegate this task to someone with a local administrator account on the<br />
Windows computer. In this case, you may want to create a temporary LDAP directory<br />
administrator account with limited privileges. For more information, see User<br />
Management.<br />
86 Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services
Note: Only Windows Vista Ultimate and Business edition can be connected to a<br />
domain.<br />
To join a Windows Vista computer to a Windows domain:<br />
1 Log in to Windows Vista using a local administrator account.<br />
2 <strong>Open</strong> the Control Panel, then open System.<br />
3 Click Change Settings.<br />
4 Click Computer Name, then click Change.<br />
5 Enter a computer name, click Domain, enter the domain name of the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
PDC, and click OK.<br />
To look up the domain name of the server, open <strong>Server</strong> Admin on the server or an<br />
administrator computer, select SMB in the <strong>Server</strong>s list, click Settings, then click General.<br />
6 Enter the name and password of an LDAP directory administrator and click OK.<br />
Setting Up Windows XP for Domain Login<br />
You can enable domain login on a Windows XP computer by joining it to the Windows<br />
domain of a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> PDC. Joining the Windows domain requires the name and<br />
password of an LDAP directory administrator account.<br />
You can delegate this task to someone with a local administrator account on the<br />
Windows computer. In this case, you may want to create a temporary LDAP directory<br />
administrator account with limited privileges. For more information, see User<br />
Management.<br />
To join a Windows XP computer to a Windows domain:<br />
1 Log in to Windows XP using a local administrator account.<br />
2 <strong>Open</strong> the Control Panel, then open System.<br />
3 Click Computer Name, then click Change.<br />
4 Enter a computer name, click Domain, enter the domain name of the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
PDC, and click OK.<br />
To look up the domain name of the server, open <strong>Server</strong> Admin on the server or an<br />
administrator computer, select SMB in the <strong>Server</strong>s list, click Settings, then click General.<br />
5 Enter the name and password of an LDAP directory administrator and click OK.<br />
Setting Up Windows 2000 for Domain Login<br />
You can enable domain login on a Windows 2000 computer by joining it to the<br />
Windows domain of a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> PDC. Joining the Windows domain requires the<br />
name and password of an LDAP directory administrator account.<br />
Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services 87
You can delegate this task to someone with a local administrator account on the<br />
Windows computer. In this case, you may want to create a temporary LDAP directory<br />
administrator account with limited privileges. For more information, see User<br />
Management.<br />
To join a Windows 2000 computer to a Windows domain:<br />
1 Log in to Windows 2000 using a local administrator account.<br />
2 <strong>Open</strong> the Control Panel, then open System.<br />
3 Click Network Identification, then click Properties.<br />
4 Enter a computer name, click Domain, enter the domain name of the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
PDC, and click OK.<br />
To look up the domain name of the server, open <strong>Server</strong> Admin on the server or an<br />
administrator computer, select SMB in the <strong>Server</strong>s list, click Settings, then click General.<br />
5 Enter the name and password of an LDAP directory administrator and click OK.<br />
Setting Up an <strong>Open</strong> <strong>Directory</strong> Replica<br />
Using <strong>Server</strong> Admin, you can set up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to be a replica of an <strong>Open</strong><br />
<strong>Directory</strong> master so it can provide the same directory information and authentication<br />
information to other systems as the master.<br />
The replica server hosts a read-only copy of the master’s LDAP directory domain. The<br />
replica server also hosts a read/write copy of the <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> and<br />
the Kerberos Key Distribution Center (KDC).<br />
<strong>Open</strong> <strong>Directory</strong> replicas provide these benefits:<br />
 In a wide area network (WAN) of local area networks (LANs) interconnected by slow<br />
links, replicas on the LANs provide servers and client computers with fast access to<br />
user accounts and other directory information.<br />
 A replica provides redundancy. If the <strong>Open</strong> <strong>Directory</strong> master fails, computers<br />
connected to it switch to a nearby replica. This automatic failover behavior is a<br />
feature of <strong>Mac</strong> <strong>OS</strong> X and <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 and 10.5.<br />
Note: If your network has a mix of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> versions 10.4 and 10.5, one version<br />
can’t be a replica of a master of the other version. An <strong>Open</strong> <strong>Directory</strong> master of <strong>v10.5</strong><br />
won’t replicate to <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4, nor will an <strong>Open</strong> <strong>Directory</strong> master of<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 replicate to <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong>.<br />
When you set up an <strong>Open</strong> <strong>Directory</strong> replica, all directory and authentication data must<br />
be copied to it from the <strong>Open</strong> <strong>Directory</strong> master. Replication can take several seconds or<br />
several minutes, depending on the size of the directory domain. Replication over a slow<br />
network link can take a long time.<br />
88 Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services
During replication, the master cannot provide directory or authentication services. You<br />
can’t use user accounts in the master LDAP directory to log in or authenticate for<br />
services until replication is finished.<br />
To minimize the disruption of directory service, set up a replica before the master LDAP<br />
directory is fully populated or at a time of day when the directory service is not<br />
needed. Having another replica set up will insulate clients of directory service from<br />
problems if the master becomes unavailable.<br />
If you change a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> computer that was connected to another directory<br />
system to be an <strong>Open</strong> <strong>Directory</strong> replica, the server remains connected to the other<br />
directory system. The server searches for user records and other information in its<br />
shared LDAP directory domain before searching in other directory systems it is<br />
connected to.<br />
To configure a server to host a replica of an <strong>Open</strong> <strong>Directory</strong> master:<br />
1 Make sure the master, the prospective replica, and every firewall between them is<br />
configured to permit SSH communications (port 22).<br />
You can enable SSH for <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> in <strong>Server</strong> Admin. Select the server in the<br />
<strong>Server</strong>s list, click Settings, click General, then select the Remote Login (SSH) option.<br />
Make sure that SSH access is not restricted to certain users or groups (using SACLs) on<br />
the prospective master. This will cause <strong>Server</strong> Admin to not have the necessary<br />
permissions during creation of the replica. You can temporarily disable SACLs in <strong>Server</strong><br />
Admin under Settings > Access.<br />
For more information about SSH, see Getting Started. For more information about<br />
permitting SSH communications through the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> firewall, see Network<br />
Services <strong>Administration</strong>.<br />
2 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
3 Click the triangle to the left of the server.<br />
The list of services appears.<br />
4 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
5 Click Settings, then click General.<br />
6 Click Change.<br />
The Service Configuration Assistant opens.<br />
7 Choose <strong>Open</strong> <strong>Directory</strong> Replica, then click Continue.<br />
8 Enter the following requested information:<br />
 IP address or DNS name of <strong>Open</strong> <strong>Directory</strong> master: Enter the IP address or DNS name of<br />
the server that is the <strong>Open</strong> <strong>Directory</strong> master.<br />
 Root password on <strong>Open</strong> <strong>Directory</strong> master: Enter the password of the <strong>Open</strong> <strong>Directory</strong><br />
master system’s root user (user name system administrator).<br />
Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services 89
 Domain administrator’s short name: Enter the name of an LDAP directory domain<br />
administrator account.<br />
 Domain administrator’s password: Enter the password of the administrator account<br />
whose name you entered.<br />
9 Click Continue.<br />
10 Confirm the <strong>Open</strong> <strong>Directory</strong> configuration settings, then click Continue.<br />
11 Click Close.<br />
12 Make sure the date, time, and time zone are correct on the replica and the master.<br />
The replica and the master should use the same network time service so their clocks<br />
remain in sync.<br />
After you set up an <strong>Open</strong> <strong>Directory</strong> replica, other computers will connect to it as<br />
needed.<br />
Computers with v10.3 or v10.4 of <strong>Mac</strong> <strong>OS</strong> X or <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> maintain a list of <strong>Open</strong><br />
<strong>Directory</strong> replicas. If one of these computers can’t contact the <strong>Open</strong> <strong>Directory</strong> master<br />
for directory and authentication services, the computer connects to the nearest replica<br />
of the master.<br />
You can configure <strong>Mac</strong> <strong>OS</strong> X computers to connect to an <strong>Open</strong> <strong>Directory</strong> replica<br />
instead of the <strong>Open</strong> <strong>Directory</strong> master for directory and authentication services. On each<br />
<strong>Mac</strong> <strong>OS</strong> X computer, you can use <strong>Directory</strong> Utility to create an LDAPv3 configuration for<br />
accessing the replica’s LDAP directory.<br />
You can also configure a DHCP service to supply the replica’s LDAP directory to<br />
<strong>Mac</strong> <strong>OS</strong> X computers that get the address of an LDAP server from the DHCP service.<br />
See “Using Advanced LDAP Service Settings” on page 133 and “Defining Automatic<br />
Search Policies” on page 129.<br />
The <strong>Open</strong> <strong>Directory</strong> master updates the replica. You can configure the master to<br />
update its replicas at a specific interval or whenever the master directory changes. For<br />
more information, see “Scheduling Replication of an <strong>Open</strong> <strong>Directory</strong> Master or Primary<br />
Domain Controller (PDC)” on page 189.<br />
Creating Multiple Replicas of an <strong>Open</strong> <strong>Directory</strong> Master<br />
To make more than one server a replica of an <strong>Open</strong> <strong>Directory</strong> master, create the<br />
replicas one at a time. If you try to create two replicas simultaneously, one attempt will<br />
succeed and the other will fail. A subsequent attempt to establish the second replica<br />
should succeed.<br />
You can have up to 32 replicas of an <strong>Open</strong> <strong>Directory</strong> master. These direct members of<br />
the <strong>Open</strong> <strong>Directory</strong> master server are known as relays. Each relay can have up to 32<br />
replicas of itself, giving you 1056 replicas in a two-tier hierarchy.<br />
90 Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services
Setting Up <strong>Open</strong> <strong>Directory</strong> Relays for Cascading Replication<br />
Using <strong>Server</strong> Admin, you can set up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to be a replica or relay of an <strong>Open</strong><br />
<strong>Directory</strong> master so it can provide the same directory information and authentication<br />
information to other computers as the master.<br />
A relay has the following two conditions:<br />
 It is a replica of an <strong>Open</strong> <strong>Directory</strong> master (a direct member).<br />
 It has replicas (supports up to 32 replicas).<br />
The process of configuring a replica of a relay is the same as configuring a replica of an<br />
<strong>Open</strong> <strong>Directory</strong> master. For more information, see “Setting Up an <strong>Open</strong> <strong>Directory</strong><br />
Replica” on page 88.<br />
Setting Up a <strong>Server</strong> as a BDC<br />
Using <strong>Server</strong> Admin, you can set up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> as a Windows BDC. The BDC<br />
provides automatic failover and backup of Windows domain login and other Windows<br />
client requests for authentication and directory services.<br />
The BDC server can provide other Windows services (SMB services), including file, print,<br />
browsing, and Windows Internet Name Service (WINS). The BDC can host home folders<br />
for users who have user accounts on the PDC/BDC.<br />
To set up a Windows BDC:<br />
1 Make sure the server is an <strong>Open</strong> <strong>Directory</strong> replica.<br />
To determine whether a server is an <strong>Open</strong> <strong>Directory</strong> replica, open <strong>Server</strong> Admin and<br />
connect to the server, click the triangle to the left of the server (to expand the list),<br />
select <strong>Open</strong> <strong>Directory</strong> from the expanded services list, then click Overview. The first line<br />
of status information states the server’s <strong>Open</strong> <strong>Directory</strong> role.<br />
2 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
3 Click the triangle to the left of the server.<br />
The list of services appears.<br />
4 From the expanded <strong>Server</strong>s list, select SMB.<br />
5 Click Settings, then click General.<br />
6 From the Role pop-up menu, choose Backup Domain Controller (BDC), then enter the<br />
following:<br />
 Description: This description appears in the Network Places window on Windows<br />
computers and is optional.<br />
Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services 91
 Computer Name: Enter the name you want Windows users to see when they connect<br />
to the server. This is the server’s NetBI<strong>OS</strong> name. The name should contain no more<br />
than 15 characters, no special characters, and no punctuation. If practical, make the<br />
server name match its unqualified DNS host name. For example, if your DNS server<br />
has an entry for your server as “server.example.com,” give your server the name<br />
“server.”<br />
 Domain: Enter the name of the Windows domain that the server will host. The<br />
domain name cannot exceed 15 characters and cannot be “workgroup.”<br />
7 Click Save.<br />
8 Enter the name and password of a user account that can administer the LDAP directory<br />
on the server, then click OK.<br />
When authenticating, you must use an LDAP directory administrator account. You can’t<br />
use a local administrator account, such as the primary server administrator account<br />
(user ID 501), to create a BDC.<br />
After setting up a BDC, you may want to change access restrictions, logging detail level,<br />
code page, domain browsing, or WINS registration. Then if Windows services aren’t<br />
running, you can start them. For more information, see Network Services <strong>Administration</strong>.<br />
Setting Up <strong>Open</strong> <strong>Directory</strong> Failover<br />
If an <strong>Open</strong> <strong>Directory</strong> master or its replicas become unavailable, its client computers<br />
with version 10.3–10.5 of <strong>Mac</strong> <strong>OS</strong> X or <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> automatically find an available<br />
replica and connect to it.<br />
Replicas only permit clients to read directory information. <strong>Directory</strong> information about<br />
a replica can’t be modified with administration tools such as Workgroup Manager.<br />
Users whose password type is <strong>Open</strong> <strong>Directory</strong> can change their passwords on<br />
computers that are connected to <strong>Open</strong> <strong>Directory</strong> replicas. The replicas synchronize<br />
password changes with the master. If the master is unavailable for a while, the replicas<br />
synchronize password changes with the master when it becomes available again.<br />
If the <strong>Open</strong> <strong>Directory</strong> master fails permanently and you have a current archive of its<br />
data, you can restore the data to a new master. Alternatively, you can promote a replica<br />
to be the master. For more information, see “Restoring an <strong>Open</strong> <strong>Directory</strong> Master” on<br />
page 195 and “Promoting an <strong>Open</strong> <strong>Directory</strong> Replica” on page 190.<br />
Note: If a failed <strong>Open</strong> <strong>Directory</strong> master or replica had client computers with <strong>Mac</strong> <strong>OS</strong> X<br />
or <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.2 or earlier, the v10.2 computers and servers do not<br />
automatically fail over to another replica.<br />
92 Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services
If you replace a failed master by promoting a replica to be the master, you can<br />
manually reconfigure each computer and server to connect to this new master or one<br />
of its replicas. You do this by using <strong>Directory</strong> Utility on each computer or server to<br />
create an LDAPv3 configuration that specifies how the computer accesses the new<br />
master or an available replica.<br />
For more information, see “Using Advanced LDAP Service Settings” on page 133.<br />
Setting Up a Connection to a <strong>Directory</strong> <strong>Server</strong><br />
Using <strong>Server</strong> Admin, you can set up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to get user records and other<br />
directory information from another server’s shared directory domain. The other server<br />
also provides authentication for its directory information. <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> still gets<br />
directory information from its own local directory domain and provides authentication<br />
for this local directory information.<br />
Important: Changing <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to be connected to another directory system<br />
instead of being an <strong>Open</strong> <strong>Directory</strong> master will turn off its shared LDAP directory<br />
domain, with the following ramifications:<br />
 User records and other information in the shared directory domain are deleted.<br />
 If other servers were connected to the master directory domain, their services may<br />
be disrupted when the user accounts and other information in the deactivated<br />
directory domain become unavailable.<br />
 Users who had accounts in the deactivated directory domain may no longer be able<br />
to access files and folders on the <strong>Open</strong> <strong>Directory</strong> master and on other servers that<br />
were connected to the master directory domain.<br />
To configure a server to get directory services from an existing system:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click General.<br />
5 Click Change.<br />
The Service Configuration Assistant opens.<br />
6 Choose “Connected to a directory server,” then click Continue.<br />
7 Confirm the <strong>Open</strong> <strong>Directory</strong> configuration settings, then click Continue.<br />
8 If the server was an <strong>Open</strong> <strong>Directory</strong> master and you are sure that users and services no<br />
longer need access to the directory data stored in the shared directory domain that the<br />
server has been hosting, click Close.<br />
Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services 93
9 Click the <strong>Open</strong> <strong>Directory</strong> Utility button to configure access to one or more directory<br />
systems.<br />
For more information about configuring access to a particular kind of directory service,<br />
see Chapter 7, “Managing <strong>Directory</strong> Clients.”<br />
If you connect <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 or later to a directory domain of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
v10.3 or earlier, users defined in the older directory domain cannot be authenticated<br />
with the NTLMv2 method. This method may be required to securely authenticate some<br />
Windows users for the Windows services of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 or later.<br />
<strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> in <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 or later supports NTLMv2<br />
authentication, but Password <strong>Server</strong> in <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.3 or earlier does not<br />
support NTLMv2.<br />
Similarly, if you configure <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 or later to access a directory domain of<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> version 10.2 or earlier, users defined in the older directory domain<br />
cannot be authenticated with the MS-CHAPv2 method. This method may be required<br />
to securely authenticate users for the VPN service of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 or later.<br />
<strong>Open</strong> <strong>Directory</strong> in <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4 supports MS-CHAPv2 authentication, but<br />
Password <strong>Server</strong> in <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> version 10.2 does not support MS-CHAPv2.<br />
10 If the server you’re configuring has access to a directory system that also hosts a<br />
Kerberos realm, you can join the server to the Kerberos realm.<br />
To join the Kerberos realm, you need the name and password of a Kerberos<br />
administrator or a user who has been delegated the authority to join the realm. For<br />
more information, see “Joining a <strong>Server</strong> to a Kerberos Realm” on page 102.<br />
Setting Up a <strong>Server</strong> as a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> PDC Domain Member<br />
Using <strong>Server</strong> Admin, you can set up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to join a Windows domain hosted<br />
by a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> PDC. A server that joins a Windows domain can provide file, print,<br />
and other services to users with accounts on the PDC.<br />
The domain member server gets authentication services from the PDC or a backup<br />
domain controller. The server can host user profiles and home folders for users who<br />
have user accounts on the PDC. The domain member server does not provide<br />
authentication services to other domain member servers.<br />
To join <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to the Windows domain of a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> PDC:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select SMB.<br />
4 Click Settings, then click General.<br />
5 From the Role pop-up menu, choose Domain Member, then enter the following:<br />
94 Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services
 Description: This description appears in the My Network Places window of Windows<br />
XP and 2000 (the Network Neighborhood window of Windows 95, 98, or ME), and is<br />
optional.<br />
 Computer Name: Enter the name you want Windows users to see when they connect<br />
to the server. This is the server’s NetBI<strong>OS</strong> name. The name should contain no more<br />
than 15 characters, no special characters, and no punctuation.<br />
If practical, make the server name match its unqualified DNS host name. For<br />
example, if your DNS server has an entry for your server as “server.example.com,” give<br />
your server the name “server.”<br />
 Domain: Enter the name of the Windows domain that the server will join. The<br />
domain must be hosted by a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> PDC. The name cannot exceed 15<br />
characters and cannot be “workgroup.”<br />
6 Click Save.<br />
7 Enter the name and password of an LDAP directory administrator account, then click<br />
OK.<br />
When authenticating, you must use an LDAP directory administrator account. You can’t<br />
use a local administrator account, such as the primary server administrator account<br />
(user ID 501), to join a Windows domain.<br />
After setting up a Windows domain member, you can change access restrictions,<br />
logging detail level, code page, domain browsing, or WINS registration. Then if<br />
Windows services aren’t running, you can start them.<br />
For more information, see Network Services <strong>Administration</strong>.<br />
Setting Up a <strong>Server</strong> as an Active <strong>Directory</strong> Domain Member<br />
Using <strong>Server</strong> Admin and <strong>Directory</strong> Utility, you can set up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to join an<br />
Active <strong>Directory</strong> domain hosted by a Windows 2000 or 2003 server.<br />
A server that joins an Active <strong>Directory</strong> domain can provide file, print, and other services<br />
to users with accounts in the Active <strong>Directory</strong> domain.<br />
The domain member server gets authentication services from Active <strong>Directory</strong>. The<br />
domain member server does not provide authentication services to other domain<br />
member servers.<br />
To join <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to the Active <strong>Directory</strong> domain of a Windows server:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Setting, then click General.<br />
Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services 95
5 Click Change.<br />
The Service Configuration Assistant opens.<br />
6 Choose “Connected to a directory server,” then click Continue.<br />
7 Confirm the <strong>Open</strong> <strong>Directory</strong> configuration settings, then click Continue.<br />
8 Click Close.<br />
9 Click <strong>Open</strong> <strong>Directory</strong> Utility.<br />
10 In the lower left corner of <strong>Directory</strong> Utility, click the lock and authenticate when<br />
prompted.<br />
11 Click Show Advanced Settings.<br />
12 Click <strong>Directory</strong> <strong>Server</strong>s (at the top).<br />
13 Click the Add (+) button.<br />
14 From the “Add a new directory of type” pop-up menu, choose Active <strong>Directory</strong>, then<br />
enter the following:<br />
 Active <strong>Directory</strong> Domain: This is the DNS name or IP address of the Active <strong>Directory</strong><br />
server.<br />
 Computer ID: Optionally edit the ID you want Active <strong>Directory</strong> to use for your server.<br />
This is the server’s NetBI<strong>OS</strong> name. The name should contain no more than 15<br />
characters, no special characters, and no punctuation. If practical, make the server<br />
name match its unqualified DNS host name. For example, if your DNS server has an<br />
entry for your server as “server.example.com,” give your server the name “server.”<br />
 AD Administrator Username and Password: Enter the user name and password of the<br />
Active <strong>Directory</strong> administrator.<br />
15 Click OK and close <strong>Directory</strong> Utility.<br />
16 Click Join Kerberos to join the server to the Active <strong>Directory</strong> Kerberos realm.<br />
17 Enter the following information:<br />
 Administrator Name: Enter the Kerberos server administrator’s user name.<br />
 Password: Enter the Kerberos server administrator password.<br />
 Realm Name: Enter the realm name of the Kerberos server.<br />
 DNS/Bonjour Name of KDC: Enter the DNS or Bonjour name of the Kerberos server.<br />
18 Click OK.<br />
19 From the <strong>Server</strong>s list, select SMB.<br />
20 Click Settings, then click General.<br />
21 Verify that the server is now a member of the Active <strong>Directory</strong> domain.<br />
You can change the server’s optional description, which appears in the Network Places<br />
window on Windows computers.<br />
96 Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services
After setting up an Active <strong>Directory</strong> domain member, you may want to change access<br />
restrictions, logging detail level, code page, domain browsing, or WINS registration.<br />
Then if Windows services aren’t already running, you can start them. For more<br />
information, see Network Services <strong>Administration</strong>.<br />
Setting Up Single Sign-On Kerberos Authentication<br />
Setting up single sign-on Kerberos authentication involves these tasks:<br />
 DNS must be made available on the network and must be configured to resolve the<br />
fully qualified DNS name of the <strong>Open</strong> <strong>Directory</strong> master server (or other Kerberos<br />
server) to its IP address. DNS must also be configured to resolve the IP address to the<br />
server’s fully qualified DNS name.<br />
 An administrator must set up a directory system to host a Kerberos realm. For more<br />
information about setting up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to host a Kerberos realm, see “Setting<br />
Up an <strong>Open</strong> <strong>Directory</strong> Kerberos Realm” on page 98.<br />
 A Kerberos administrator of an <strong>Open</strong> <strong>Directory</strong> master can delegate the authority to<br />
join servers to the <strong>Open</strong> <strong>Directory</strong> master’s Kerberos realm. (The administrator does<br />
not need delegated authority. A Kerberos administrator has implicit authority to join<br />
any server to the Kerberos realm.) See “Delegating Authority to Join an <strong>Open</strong><br />
<strong>Directory</strong> Kerberos Realm” on page 100.<br />
 A Kerberos administrator or users with delegated authority must join servers to the<br />
Kerberos realm, which then provides single sign-on Kerberos authentication for<br />
services provided by the servers that have joined. See “Joining a <strong>Server</strong> to a Kerberos<br />
Realm” on page 102.<br />
 All computers using Kerberos must be set to the correct date, time, and time zone,<br />
and they must be configured to use the same network time server. Kerberos<br />
depends on the clocks of all participating computers being in sync.<br />
When you are configuring an <strong>Open</strong> <strong>Directory</strong> master, make sure your DNS is correctly<br />
configured and running before you start <strong>Open</strong> <strong>Directory</strong> service for the first time. If<br />
DNS is not configured properly or is not running when you start <strong>Open</strong> <strong>Directory</strong>,<br />
Kerberos will not function properly.<br />
When <strong>Open</strong> <strong>Directory</strong> is started for the first time, Kerberos uses DNS service to<br />
generate configuration settings. If your DNS server is not available when Kerberos is<br />
initially started, its configurations will be invalid and it will not work properly. After<br />
Kerberos is running and has generated its configuration file, it will no longer<br />
completely depend on DNS and changes to DNS will not affect Kerberos.<br />
The individual services of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> do not require configuration for single signon<br />
or Kerberos.<br />
Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services 97
The following services are ready for single sign-on Kerberos authentication on every<br />
server with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> version 10.5 or later that has joined or is an <strong>Open</strong> <strong>Directory</strong><br />
master or replica:<br />
 Login window<br />
 Mail service<br />
 AFP<br />
 FTP<br />
 SMB (as a member of an Active <strong>Directory</strong> Kerberos realm)<br />
 iChat<br />
 Print service<br />
 NFS<br />
 Xgrid service<br />
 VPN<br />
 Apache web service<br />
 LDAPv3 directory service (on an <strong>Open</strong> <strong>Directory</strong> master or replica).<br />
Setting Up an <strong>Open</strong> <strong>Directory</strong> Kerberos Realm<br />
You can provide single sign-on Kerberos authentication on your network by setting up<br />
an <strong>Open</strong> <strong>Directory</strong> master.<br />
You can set up an <strong>Open</strong> <strong>Directory</strong> master during initial configuration that follows<br />
installation of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>, but if you set up <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to have a different<br />
<strong>Open</strong> <strong>Directory</strong> role, you can change its role to that of <strong>Open</strong> <strong>Directory</strong> master by using<br />
<strong>Server</strong> Admin.<br />
For more information, see “Setting Up an <strong>Open</strong> <strong>Directory</strong> Master” on page 83 and<br />
“Starting Kerberos After Setting Up an <strong>Open</strong> <strong>Directory</strong> Master” on page 99.<br />
A server that is an <strong>Open</strong> <strong>Directory</strong> master requires no other configuration to support<br />
single sign-on Kerberos authentication for Kerberized services that the server provides.<br />
The server can also support single sign-on Kerberos authentication for Kerberized<br />
services of other servers on the network. The other servers must be set up to join the<br />
<strong>Open</strong> <strong>Directory</strong> Kerberos realm.<br />
For more information, see “Delegating Authority to Join an <strong>Open</strong> <strong>Directory</strong> Kerberos<br />
Realm” on page 100, and “Joining a <strong>Server</strong> to a Kerberos Realm” on page 102.<br />
Important: An <strong>Open</strong> <strong>Directory</strong> master requires DNS to be properly configured so it can<br />
provide Kerberos and single sign-on authentication. In addition:<br />
98 Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services
 DNS service must be configured to resolve the fully qualified DNS names of all<br />
servers (including the <strong>Open</strong> <strong>Directory</strong> master) to their IP addresses and to provide<br />
the corresponding reverse lookups. For more information about setting up DNS<br />
service, see Network Services <strong>Administration</strong>.<br />
 The <strong>Open</strong> <strong>Directory</strong> master server’s Network preferences must be configured to use<br />
the DNS server that resolves the server’s name. (If the <strong>Open</strong> <strong>Directory</strong> master server<br />
provides its own DNS service, its Network preferences must be configured to use<br />
itself as a DNS server.)<br />
Starting Kerberos After Setting Up an <strong>Open</strong> <strong>Directory</strong> Master<br />
If Kerberos doesn’t start when you set up an <strong>Open</strong> <strong>Directory</strong> master, you can use <strong>Server</strong><br />
Admin to start it manually, but first you must fix the problem that prevented Kerberos<br />
from starting. Usually the problem is that the DNS service isn’t correctly configured or<br />
isn’t running.<br />
Note: After you manually start Kerberos, users whose accounts have <strong>Open</strong> <strong>Directory</strong><br />
passwords and were created in the <strong>Open</strong> <strong>Directory</strong> master’s LDAP directory while<br />
Kerberos was stopped may need to reset their passwords the next time they log in. A<br />
user account is therefore affected only if all recoverable authentication methods for<br />
<strong>Open</strong> <strong>Directory</strong> passwords were disabled while Kerberos was stopped.<br />
To start Kerberos manually on an <strong>Open</strong> <strong>Directory</strong> master:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Refresh (or choose View > Refresh) and verify the status of Kerberos as reported in<br />
the Overview pane.<br />
If Kerberos is running, there’s nothing more to do.<br />
5 Use Network Utility (in /Applications/Utilities/) to do a DNS lookup of the <strong>Open</strong><br />
<strong>Directory</strong> master’s DNS name and a reverse lookup of the IP address.<br />
If the server’s DNS name or IP address doesn’t resolve correctly:<br />
 In the Network pane of System Preferences, look at the TCP/IP settings for the<br />
server’s primary network interface (usually built-in Ethernet). Make sure the first DNS<br />
server listed is the one that resolves the <strong>Open</strong> <strong>Directory</strong> server’s name.<br />
 Check the configuration of DNS service and make sure it’s running.<br />
6 In <strong>Server</strong> Admin, select <strong>Open</strong> <strong>Directory</strong> for the master server, click Settings, then click<br />
General.<br />
7 Click Kerberize, then enter the following information:<br />
Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services 99
 Administrator Name and Password: You must authenticate as an administrator of the<br />
<strong>Open</strong> <strong>Directory</strong> master’s LDAP directory.<br />
 Realm Name: This field is preset to be the same as the server’s DNS name converted<br />
to capital letters. This is the convention for naming a Kerberos realm. If necessary, you<br />
can enter a different name.<br />
Delegating Authority to Join an <strong>Open</strong> <strong>Directory</strong> Kerberos Realm<br />
Using <strong>Server</strong> Admin, you can delegate the authority to join a server to an <strong>Open</strong><br />
<strong>Directory</strong> master server for single sign-on Kerberos authentication.<br />
You can delegate authority to one or more user accounts. The user accounts you<br />
delegate authority to must have a password type of <strong>Open</strong> <strong>Directory</strong> and must reside in<br />
the LDAP directory of the <strong>Open</strong> <strong>Directory</strong> master server. The dependent server you are<br />
delegating authority for must have <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.3 or later.<br />
Note: If an account with delegated Kerberos authority is deleted and recreated on the<br />
<strong>Open</strong> <strong>Directory</strong> master server, the new account will not have authority to join the<br />
dependent server to the <strong>Open</strong> <strong>Directory</strong> master’s Kerberos realm.<br />
A Kerberos administrator (that is, an <strong>Open</strong> <strong>Directory</strong> LDAP administrator) doesn’t need<br />
delegated authority to join dependent servers to the <strong>Open</strong> <strong>Directory</strong> Kerberos realm. A<br />
Kerberos administrator has implicit authority to join any server to the Kerberos realm.<br />
To delegate authority to join an <strong>Open</strong> <strong>Directory</strong> Kerberos realm:<br />
1 In Workgroup Manager, create a computer group in the LDAP directory domain of the<br />
<strong>Open</strong> <strong>Directory</strong> master server, or select an existing computer group in this directory:<br />
 To select an existing computer group, click Accounts or choose View > Accounts,<br />
click the Computer Group button (above the accounts list), and select the computer<br />
group you want to use.<br />
 If the LDAP server doesn’t have a computer group that you want to add the<br />
dependent server to, you can create one:<br />
Click Accounts, then click the Computers button (above the accounts list).<br />
Click the small globe icon above the list of accounts and use the pop-up menu to<br />
open the <strong>Open</strong> <strong>Directory</strong> master’s LDAP directory.<br />
Click the lock and authenticate as an administrator of the LDAP directory.<br />
Click Computers Group button (above the accounts list), then click New Computer<br />
Group or choose <strong>Server</strong> > New Computer Group.<br />
Enter a list name (for example, Kerberized <strong>Server</strong>s).<br />
2 Click Members, then click the Add (+) button and enter the following:<br />
100 Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services
 Address: Enter the Ethernet address of the dependent server’s primary Ethernet port.<br />
The primary Ethernet port is the first port listed in the Network Status pane of the<br />
dependent server’s Network preferences address. This port’s address appears as the<br />
Ethernet ID in the Ethernet pane of Network preferences. If you do not enter the<br />
correct Ethernet address, the dependent server cannot join the <strong>Open</strong> <strong>Directory</strong><br />
master for Kerberos authentication.<br />
 Name: Enter the fully qualified DNS name of the dependent server, not just its host<br />
name. For example, the name might be server2.example.com (not server2). This<br />
name is used to create Kerberos principals in the KDC. If this name is incorrect, users<br />
cannot authenticate using Kerberos. Your DNS system must have an entry for the<br />
dependent server’s name and a reverse lookup entry for the dependent server’s IP<br />
address.<br />
 Use this name as the Computer Name: Does not affect Kerberos operations.<br />
 Comment: Is optional and purely informational.<br />
3 Click Save to save your changes to the computer group.<br />
4 Click Preferences and make sure the computer group has no managed preference<br />
settings.<br />
If any item in the array of preference categories has a small arrow next to its icon, the<br />
item has managed preference settings. To remove managed preferences from an item,<br />
click the item, select Not Managed, and click Apply Now. If the item has multiple panes,<br />
select Not Managed in each pane, then click Apply Now.<br />
5 If you want to delegate Kerberos authority to one or more user accounts, create the<br />
accounts:<br />
 Make sure you are working in the LDAP directory of the <strong>Open</strong> <strong>Directory</strong> master<br />
server. If necessary, click the small globe icon and use the pop-up menu to open this<br />
directory. Then click the lock and authenticate as an administrator of this directory.<br />
 Click the Users button (on the left), then click New User or choose <strong>Server</strong> > New User.<br />
 Enter a name, short name, and password.<br />
 Make sure “User can access account” or “User may administer this server” are not<br />
selected.<br />
You can change settings in other panes, but do not change the User Password Type<br />
setting in the Advanced pane. A user with delegated Kerberos authority must have<br />
an <strong>Open</strong> <strong>Directory</strong> password.<br />
6 Click Save to save the new user account.<br />
7 <strong>Open</strong> <strong>Server</strong> Admin and connect to the <strong>Open</strong> <strong>Directory</strong> master server.<br />
8 Click the triangle to the left of the server.<br />
The list of services appears.<br />
9 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services 101
10 Click Settings, then click General.<br />
11 Confirm that the Role is <strong>Open</strong> <strong>Directory</strong> Master, then click Add Kerberos Record and<br />
enter the following information:<br />
 Administrator Name: Enter the name of an LDAP directory administrator on the <strong>Open</strong><br />
<strong>Directory</strong> master server.<br />
 Administrator Password: Enter the password of the administrator account you<br />
entered.<br />
 Configuration Record Name: Enter the fully qualified DNS name as you entered it<br />
when adding the dependent server to the computer group in step 2.<br />
 Delegated Administrators: Enter a short name or a long name for each user account<br />
to which you want to delegate Kerberos authority for the specified server. To prevent<br />
problems if this user account is deleted in the future, consider entering at least two<br />
names.<br />
12 Click Add, then click Save to delegate Kerberos authority as specified.<br />
To delegate authority for more than one dependent server, repeat this procedure for<br />
each one.<br />
For more information about joining a server to an <strong>Open</strong> <strong>Directory</strong> Kerberos realm, see<br />
“Joining a <strong>Server</strong> to a Kerberos Realm” on page 102.<br />
Joining a <strong>Server</strong> to a Kerberos Realm<br />
Using <strong>Server</strong> Admin, a Kerberos administrator or a user whose account has the properly<br />
delegated authority can join <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to a Kerberos realm.<br />
The server can join only one Kerberos realm. It can be an <strong>Open</strong> <strong>Directory</strong> Kerberos<br />
realm, an Active <strong>Directory</strong> Kerberos realm, or an existing realm based on MIT Kerberos.<br />
To join an <strong>Open</strong> <strong>Directory</strong> Kerberos realm, you need a Kerberos administrator account<br />
or a user account with delegated Kerberos authority. For more information, see<br />
“Delegating Authority to Join an <strong>Open</strong> <strong>Directory</strong> Kerberos Realm” on page 100.<br />
To join a server to a Kerberos realm:<br />
1 Make sure the server you want to join to the Kerberos realm is configured to access the<br />
shared directory domain of the Kerberos server.<br />
To confirm, open <strong>Directory</strong> Utility on the server you want to join to the Kerberos realm<br />
or connect to the server using <strong>Directory</strong> Utility on another computer. Click Search<br />
Policy, then click Authentication and make sure the Kerberos server’s directory domain<br />
is listed. If it is not listed, see Chapter 7, “Managing <strong>Directory</strong> Clients,” for instructions on<br />
configuring access to the directory.<br />
2 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server you want to join to the Kerberos realm.<br />
102 Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services
3 Click the triangle to the left of the server.<br />
The list of services appears.<br />
4 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
5 Click Settings, then click General.<br />
6 Confirm that the Role is Connected to a <strong>Directory</strong> <strong>Server</strong>, then click Join Kerberos<br />
and enter the following information:<br />
 For an <strong>Open</strong> <strong>Directory</strong> Kerberos realm or an Active <strong>Directory</strong> Kerberos realm,<br />
choose the realm from the pop-up menu and enter the name and password of a<br />
Kerberos administrator or a user with delegated Kerberos authority for the server.<br />
 For an MIT-based Kerberos realm, enter the name and password of a Kerberos<br />
administrator, the Kerberos realm name, and the DNS name of the Kerberos<br />
KDC server.<br />
Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services 103
104 Chapter 5 Setting Up <strong>Open</strong> <strong>Directory</strong> Services
6 Managing<br />
User Authentication<br />
6<br />
Learn how to reset user passwords, change password types,<br />
set password policies, select authentication methods, and<br />
perform other tasks using Workgroup Manger.<br />
Workgroup Manager provides a centralized method of managing <strong>Mac</strong> <strong>OS</strong> X computers<br />
to control access to software and removable media, and to provide a consistent<br />
environment for different users. You also use Workgroup Manager to manage user<br />
authentication. For more information on Workgroup Manager, see User Management.<br />
You can manage the user authentication information stored in directory domains.<br />
For task descriptions and instructions, see:<br />
 “Composing a Password” on page 106<br />
 “Changing a User’s Password” on page 106<br />
 “Resetting the Passwords of Multiple Users” on page 107<br />
 “Changing a User’s Password Type” on page 108<br />
This includes changing the password type to <strong>Open</strong> <strong>Directory</strong>, shadow password, or<br />
crypt password; and enabling single sign-on Kerberos.<br />
 “Enabling Single Sign-On Kerberos Authentication for a User” on page 111<br />
 “Changing the Global Password Policy” on page 111<br />
 “Setting Password Policies for Individual Users” on page 112<br />
 “Selecting Authentication Methods for Shadow Password Users” on page 113<br />
 “Selecting Authentication Methods for <strong>Open</strong> <strong>Directory</strong> Passwords” on page 114<br />
 “Assigning Administrator Rights for <strong>Open</strong> <strong>Directory</strong> Authentication” on page 115<br />
 “Keeping the Primary Administrator’s Passwords in Sync” on page 116<br />
 “Enabling LDAP Bind Authentication for a User” on page 116<br />
 “Setting Passwords of Exported or Imported Users” on page 117<br />
 “Migrating Passwords From <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.1 or Earlier” on page 117<br />
105
Composing a Password<br />
The password associated with a user’s account must be entered by the user when he or<br />
she authenticates for login or other services. The password is case sensitive (except for<br />
SMB-LAN Manager passwords) and is masked on the screen as it is entered.<br />
Regardless of the password type you choose for a user, here are guidelines for<br />
composing a password for <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> user accounts:<br />
 A password should contain letters, numbers, and symbols in combinations that won’t<br />
be easily guessed by unauthorized users. Passwords should not consist of words.<br />
Good passwords include digits and symbols (such as # or $), or they consist of the<br />
first letter of all words in a phrase. Use both uppercase and lowercase letters.<br />
 Avoid spaces and Option-key combinations.<br />
 Avoid characters that can’t be entered on computers the user will be using or that<br />
might require knowing a special keystroke combination to enter correctly on<br />
different keyboards and platforms.<br />
 Some network protocols do not support passwords that contain leading spaces,<br />
embedded spaces, or trailing spaces.<br />
 A zero-length password is not recommended. <strong>Open</strong> <strong>Directory</strong> and some systems<br />
(such as LDAP bind) do not support a zero-length password.<br />
 For maximum compatibility with computers and services your users might access,<br />
use only ASCII characters for passwords.<br />
Changing a User’s Password<br />
You can use Workgroup Manager to change the password of a user account defined in<br />
any directory domain you have read/write access to. For example, you can change the<br />
password of a user account in the LDAP directory of an <strong>Open</strong> <strong>Directory</strong> master.<br />
Important: If you change the password of a user account that’s used to authenticate a<br />
computer’s LDAP directory connection, you must make the same change to the<br />
affected computer’s LDAP connection settings or configure the LDAP directory and all<br />
connections to it to use trusted binding.<br />
For more information, see “Changing the Password Used for Authenticating an LDAP<br />
Connection” on page 153 or “Setting a Binding Policy for an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>” on<br />
page 184 and “Stopping Trusted Binding with an LDAP <strong>Directory</strong>” on page 150.<br />
To change a user’s password:<br />
1 <strong>Open</strong> Workgroup Manager, click the Accounts button, then click the User button.<br />
2 <strong>Open</strong> the directory domain that contains the user account whose password you want<br />
to change, and authenticate as an administrator of the domain.<br />
To open a directory domain, click the small globe icon above the list of users and<br />
choose from the pop-up menu.<br />
106 Chapter 6 Managing User Authentication
If the user’s password type is <strong>Open</strong> <strong>Directory</strong>, you must authenticate as an<br />
administrator whose password type is <strong>Open</strong> <strong>Directory</strong>.<br />
3 Select the account whose password needs to be changed.<br />
4 Enter a password in the Basic pane, then click Save.<br />
5 Tell the user the new password so he or she can log in.<br />
After the user logs in to <strong>Mac</strong> <strong>OS</strong> X with the new password, the user can change the<br />
password by clicking Accounts in System Preferences.<br />
If you change the password of an account whose password type is <strong>Open</strong> <strong>Directory</strong> and<br />
the account resides in the LDAP directory of an <strong>Open</strong> <strong>Directory</strong> replica or master, the<br />
change becomes synchronized with the master and its replicas. <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
synchronizes changes to <strong>Open</strong> <strong>Directory</strong> passwords among a master and its replicas.<br />
Resetting the Passwords of Multiple Users<br />
You can use Workgroup Manager to simultaneously select multiple user accounts and<br />
change them to have the same password type and the same temporary password.<br />
To change the password type and password of multiple user accounts:<br />
1 <strong>Open</strong> Workgroup Manager, click the Accounts button, then click the User button.<br />
2 <strong>Open</strong> the directory domain that contains the user account whose password types and<br />
passwords you want to reset and authenticate as an administrator of the domain.<br />
To open a directory domain, click the small globe icon above the list of users and<br />
choose from the pop-up menu.<br />
If you want to set the password type to be <strong>Open</strong> <strong>Directory</strong>, you must authenticate as<br />
an administrator whose password type is <strong>Open</strong> <strong>Directory</strong>.<br />
3 Command-click or Shift-click user accounts to select accounts whose password type<br />
must be changed.<br />
4 Enter a password in the Basic pane, then set the User Password Type option in the<br />
Advanced pane.<br />
5 Click Save.<br />
6 Tell the users the temporary password so they can log in.<br />
After logging in with the temporary password, a user can change the password by<br />
clicking Accounts in System Preferences.<br />
If you change the password of accounts whose password type is <strong>Open</strong> <strong>Directory</strong> and<br />
the accounts reside in the LDAP directory of an <strong>Open</strong> <strong>Directory</strong> replica or master, the<br />
change becomes synchronized with the master and its replicas. <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
synchronizes changes to <strong>Open</strong> <strong>Directory</strong> passwords among a master and its replicas.<br />
Chapter 6 Managing User Authentication 107
Changing a User’s Password Type<br />
You can set the password type in the Advanced pane of Workgroup Manager to one of<br />
the following:<br />
 <strong>Open</strong> <strong>Directory</strong>: Enables multiple legacy authentication methods and also enables<br />
single sign-on Kerberos authentication if the user’s account is in the LDAP directory<br />
of an <strong>Open</strong> <strong>Directory</strong> master or replica. <strong>Open</strong> <strong>Directory</strong> passwords are stored<br />
separately from the directory domain in the <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong><br />
database and the Kerberos KDC. See “Changing the Password Type to <strong>Open</strong><br />
<strong>Directory</strong>” on page 108.<br />
 Shadow password: Enables multiple legacy authentication methods for user accounts<br />
in the local directory domain. Shadow passwords are stored separately from the<br />
directory domain in files readable only by the root user account. See “Changing the<br />
Password Type to Shadow Password” on page 110.<br />
 Crypt password: Provides basic authentication for a user account in a shared directory<br />
domain. A crypt password is stored in the user account record in the directory<br />
domain. A crypt password is required to log in to <strong>Mac</strong> <strong>OS</strong> X v10.1 or earlier. See<br />
“Changing the Password Type to Crypt Password” on page 110.<br />
Changing the Password Type to <strong>Open</strong> <strong>Directory</strong><br />
Using Workgroup Manager, you can specify that a user account have an <strong>Open</strong> <strong>Directory</strong><br />
password stored in secure databases apart from the directory domain. User accounts in<br />
the following directory domains can have <strong>Open</strong> <strong>Directory</strong> passwords:<br />
 LDAP directory domain on <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.3–10.5<br />
 Local directory domain of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.3 or a server upgraded from v10.3<br />
 <strong>Directory</strong> domain on <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.2 that is configured to use a Password<br />
<strong>Server</strong><br />
The <strong>Open</strong> <strong>Directory</strong> password type supports single sign-on using Kerberos<br />
authentication. It also supports the <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong>, which offers<br />
Simple Authentication and Security Layer (SASL) authentication protocols, including<br />
APOP, CRAM-MD5, DHX, Digest-MD5, MS-CHAPv2, NTLMv2, NTLM (also referred to as<br />
Windows NT or SMB-NT), LAN Manager (LM), and WebDAV-Digest.<br />
Note: To set a user account’s password type to <strong>Open</strong> <strong>Directory</strong>, you must have<br />
administrator rights for <strong>Open</strong> <strong>Directory</strong> authentication in the directory domain that<br />
contains the user account. This means you must authenticate as a directory domain<br />
administrator whose password type is <strong>Open</strong> <strong>Directory</strong>. For more information, see<br />
“Assigning Administrator Rights for <strong>Open</strong> <strong>Directory</strong> Authentication” on page 115.<br />
108 Chapter 6 Managing User Authentication
To specify that a user account have an <strong>Open</strong> <strong>Directory</strong> password:<br />
1 Make sure the user’s account resides in a directory domain that supports <strong>Open</strong><br />
<strong>Directory</strong> authentication.<br />
The directory domains that support <strong>Open</strong> <strong>Directory</strong> authentication are listed earlier in<br />
this topic.<br />
2 In Workgroup Manager, open the account you want to work with (if it is not open).<br />
To open an account, click the Accounts button, then click the Users button. Click the<br />
small globe icon above the list of users and choose from the pop-up menu to open the<br />
directory domain where the user’s account resides. Click the lock and authenticate as a<br />
directory domain administrator whose password type is <strong>Open</strong> <strong>Directory</strong>. Then select<br />
the user in the list.<br />
3 Click Advanced.<br />
4 From the User Password Type pop-up menu, choose <strong>Open</strong> <strong>Directory</strong>.<br />
5 When prompted, enter and verify a new password.<br />
The password must contain no more than 512 bytes (512 characters or fewer, depending<br />
on the language), although the network authentication protocol can impose different<br />
limits; for example, 128 characters for NTLMv2 and NTLM and 14 for LAN Manager.<br />
“Composing a Password” on page 106 provides guidelines for choosing passwords.<br />
6 In the Advanced pane, click Options to set up the user’s password policy, and click OK<br />
after you finish specifying options.<br />
If you select “Disable login: on specific date,” use the up and down arrows to set the<br />
date.<br />
If you select an option that requires resetting (changing) the password, remember that<br />
not all protocols support changing passwords. For example, users can’t change their<br />
passwords when authenticating for IMAP mail service.<br />
The password ID is a unique 128-bit number assigned when the password is created in<br />
the <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> database. It can be helpful for troubleshooting,<br />
because it appears in the Password <strong>Server</strong> log when a problem occurs. For more<br />
information, see “Viewing <strong>Open</strong> <strong>Directory</strong> Status and Logs” on page 178. View this<br />
<strong>Open</strong> <strong>Directory</strong> log in <strong>Server</strong> Admin.<br />
7 Click Save.<br />
Chapter 6 Managing User Authentication 109
Changing the Password Type to Crypt Password<br />
If necessary, you can use Workgroup Manager to specify a crypt password for a user’s<br />
account. You can only use crypt passwords for a user account in a shared directory<br />
domain. The user account can be part of an LDAP directory domain or a legacy shared<br />
NetInfo domain (only available when connected to a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.4, v10.3, or<br />
v10.2).<br />
User accounts not used on computers that require a crypt password should have an<br />
<strong>Open</strong> <strong>Directory</strong> password or a shadow password. A crypt password is required only for<br />
logging in to a computer with <strong>Mac</strong> <strong>OS</strong> X v10.1 or earlier and on computers with some<br />
types of UNIX.<br />
A crypt password is stored as an encrypted value, or hash, in the user account record in<br />
the directory domain. Because the crypt password can be recovered from the directory<br />
domain, it is subject to offline attack and is less secure than other password types.<br />
To specify that a user account have a crypt password:<br />
1 In Workgroup Manager, open the account you want to work with (if it is not open).<br />
To open an account, click the Accounts button, then click the Users button. Click the<br />
small globe icon above the list of users and choose from the pop-up menu to open the<br />
directory domain where the user’s account resides. Click the lock and authenticate as a<br />
directory domain administrator, then select the user in the list.<br />
2 Click Advanced.<br />
3 From the User Password Type pop-up menu, choose Crypt Password.<br />
4 When prompted, enter and verify a password.<br />
A crypt password can be at most eight bytes (eight ASCII characters) long. If you enter<br />
a longer password, only the first eight bytes are used.<br />
5 Click Save.<br />
Changing the Password Type to Shadow Password<br />
Using Workgroup Manager, you can specify that a user have a shadow password stored<br />
in a secure file apart from the directory domain. Only users whose accounts reside in<br />
the local directory domain can have a shadow password.<br />
To specify that a user account have a shadow password:<br />
1 In Workgroup Manager, open the account you want to work with (if it is not open).<br />
To open an account, click the Accounts button, then click the Users button. Click the<br />
small globe icon above the list of users and choose from the pop-up menu to open the<br />
local directory domain where the user’s account resides. Click the lock and authenticate<br />
as a directory domain administrator, then select the user in the list.<br />
2 Click Advanced.<br />
110 Chapter 6 Managing User Authentication
3 From the User Password Type pop-up menu, choose Shadow Password.<br />
Note: You can only assign local user accounts to use shadow passwords.<br />
4 When prompted, enter and verify a password.<br />
A long password is truncated for some authentication methods. Up to 128 characters of<br />
the password are used for NTLMv2 and NTLM, and the first 14 characters are used for<br />
LAN Manager.<br />
For guidelines on choosing passwords, see “Composing a Password” on page 106.<br />
5 In the Advanced pane, click Options to set up the user’s password policy, then click OK<br />
after you finish specifying options.<br />
If you select “Disable login: on specific date,” use the up and down arrows to set the<br />
date.<br />
If you use a policy that requires user password changing, remember that not all<br />
protocols support changing passwords. For example, users can’t change their<br />
passwords when authenticating for IMAP mail service.<br />
6 In the Advanced pane, click Security to enable or disable authentication methods for<br />
the user, then click OK after you finish.<br />
For more information, see “Setting Password Policies for Individual Users” on page 112.<br />
7 Click Save.<br />
Enabling Single Sign-On Kerberos Authentication for a User<br />
You enable single sign-on Kerberos authentication for a user account in an LDAP<br />
directory of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> by setting the account’s password type to <strong>Open</strong> <strong>Directory</strong><br />
in the Advanced pane of Workgroup Manager.<br />
Changing the Global Password Policy<br />
Using <strong>Server</strong> Admin, you can set a global password policy for user accounts in a<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> directory domain.<br />
The global password policy affects user accounts in the server’s local directory domain.<br />
If the server is an <strong>Open</strong> <strong>Directory</strong> master or replica, the global password policy also<br />
affects user accounts that have an <strong>Open</strong> <strong>Directory</strong> password type in the server’s LDAP<br />
directory domain.<br />
If you change the global password policy on an <strong>Open</strong> <strong>Directory</strong> replica, the policy<br />
settings become synchronized with the master and any other replicas of it.<br />
Administrator accounts are exempt from password policies. Each user can have an<br />
individual password policy that overrides global password policy settings. For more<br />
information, see “Setting Password Policies for Individual Users” on page 112.<br />
Chapter 6 Managing User Authentication 111
Kerberos and <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> maintain password policies separately.<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> synchronizes the Kerberos password policy rules with <strong>Open</strong> <strong>Directory</strong><br />
Password <strong>Server</strong> password policy rules.<br />
To change the global password policy of user accounts in the same domain:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to an <strong>Open</strong> <strong>Directory</strong> master or replica server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click Policy.<br />
5 Click Passwords, then set the password policy options you want enforced for users who<br />
do not have individual password policies.<br />
If you select an option that requires resetting the password, remember that some<br />
service protocols don’t permit users to change passwords. For example, users can’t<br />
change their passwords when authenticating for IMAP mail service.<br />
6 Click Save.<br />
Replicas of the <strong>Open</strong> <strong>Directory</strong> master automatically inherit its global password policy.<br />
From the Command Line<br />
You can also set password policies by using the pwpolicy command in Terminal. For<br />
more information, see the <strong>Open</strong> <strong>Directory</strong> chapter of Command-Line <strong>Administration</strong>.<br />
Setting Password Policies for Individual Users<br />
Using Workgroup Manager, you can set password policies for user accounts whose<br />
password type is <strong>Open</strong> <strong>Directory</strong> or Shadow Password. The password policy for a user<br />
overrides the global password policy defined in the Authentication Settings pane of<br />
<strong>Open</strong> <strong>Directory</strong> service in <strong>Server</strong> Admin.<br />
The password policy for a mobile user account applies when the account is used while<br />
the mobile computer is disconnected from the network. The password policy from the<br />
corresponding network user account applies while the mobile computer is connected<br />
to the network.<br />
Administrator accounts are exempt from password policies.<br />
To set a password policy for a user account that has an <strong>Open</strong> <strong>Directory</strong> password, you<br />
must have administrator rights for <strong>Open</strong> <strong>Directory</strong> authentication in the directory<br />
domain that contains the user account. This means you must authenticate as a<br />
directory domain administrator whose password type is <strong>Open</strong> <strong>Directory</strong>.<br />
112 Chapter 6 Managing User Authentication
For more information, see “Assigning Administrator Rights for <strong>Open</strong> <strong>Directory</strong><br />
Authentication” on page 115.<br />
Kerberos and <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> maintain password policies separately.<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> synchronizes Kerberos password policy rules with <strong>Open</strong> <strong>Directory</strong><br />
Password <strong>Server</strong> password policy rules.<br />
Do not use the Options button in the Advanced pane to set up password policies for<br />
directory domain administrators. Password policies are not enforced for administrator<br />
accounts. <strong>Directory</strong> domain administrators must be able to change the password<br />
policies of user accounts.<br />
To change the password policy for a user account:<br />
1 In Workgroup Manager, open the account you want to work with (if it is not open).<br />
To open an account, click the Accounts button, then click the Users button. Click the<br />
small globe icon above the list of users and choose from the pop-up menu to open the<br />
directory domain where the user’s account resides. Click the lock and authenticate as a<br />
directory domain administrator whose password type is <strong>Open</strong> <strong>Directory</strong>. Then select<br />
the user in the list.<br />
2 Click Advanced, then click Options.<br />
You can click Options only if the password type is <strong>Open</strong> <strong>Directory</strong> or Shadow Password.<br />
3 Change password policy options, then click OK.<br />
If you select an option that requires resetting (changing) the password, remember that<br />
some service protocols don’t permit users to change passwords. For example, users<br />
can’t change their passwords when authenticating for IMAP mail service.<br />
4 Click Save.<br />
From the Command Line<br />
You can also set password policies by using the pwpolicy command in Terminal. For<br />
more information, see the <strong>Open</strong> <strong>Directory</strong> chapter of Command-Line <strong>Administration</strong>.<br />
Selecting Authentication Methods for Shadow Password<br />
Users<br />
Using Workgroup Manager, you can select which authentication methods will be<br />
available for a user account whose password type is Shadow Password.<br />
A shadow password supports available authentication methods for compatibility with<br />
client software. If you know the user will never use client software that requires a<br />
particular authentication method, you can disable the method. For more information,<br />
see “Disabling Shadow Password Authentication Methods” on page 55.<br />
Chapter 6 Managing User Authentication 113
If you disable an authentication method, its hash is removed from the user’s shadow<br />
password file the next time the user authenticates.<br />
If you enable an authentication method that was disabled, the enabled method’s hash<br />
is added to the user’s shadow password file the next time the user authenticates for a<br />
service that can use a clear text password, such as a login window or AFP.<br />
Alternatively, the user’s password can be reset to add the newly enabled method’s<br />
hash. The user can reset the password, or a directory administrator can do it.<br />
To enable or disable authentications for user accounts whose password type is <strong>Open</strong><br />
<strong>Directory</strong>, see the next topic.<br />
To enable or disable authentication methods for a Shadow Password user:<br />
1 In Workgroup Manager, open the account you want to work with (if it is not open).<br />
To open an account, click the Accounts button, then click the Users button. Click the<br />
small globe icon above the list of users and choose from the pop-up menu to open the<br />
local directory domain where the user’s account resides. Click the lock and authenticate<br />
as a directory domain administrator. Then select the user in the list.<br />
2 Click Advanced, then click Security.<br />
You can click Security only if the password type is Shadow Password.<br />
3 Select the authentication methods you want enabled, deselect the authentication<br />
methods you want disabled, then click OK.<br />
4 Click Save.<br />
From the Command Line<br />
You can also enable or disable authentication methods for a user with a shadow<br />
password by using the pwpolicy command in Terminal. For more information, see the<br />
<strong>Open</strong> <strong>Directory</strong> chapter of Command-Line <strong>Administration</strong>.<br />
Selecting Authentication Methods for <strong>Open</strong> <strong>Directory</strong><br />
Passwords<br />
Using <strong>Server</strong> Admin, you can select which authentication methods will be available for<br />
user accounts whose password type is <strong>Open</strong> <strong>Directory</strong>. The <strong>Open</strong> <strong>Directory</strong> Password<br />
<strong>Server</strong> supports the available authentication methods for compatibility with client<br />
software. If you know that users will never use client software that requires a particular<br />
authentication method, you can disable the method.<br />
For more information, see “Disabling <strong>Open</strong> <strong>Directory</strong> Authentication Methods” on<br />
page 54.<br />
114 Chapter 6 Managing User Authentication
Important: If you disable an authentication method, its hash is removed from the<br />
password database the next time the user authenticates. If you enable an<br />
authentication method that was disabled, every <strong>Open</strong> <strong>Directory</strong> password must be<br />
reset to add the enabled method’s hash to the password database. The user can reset<br />
the password, or a directory administrator can do it.<br />
To enable or disable authentication methods for user accounts whose password type is<br />
Shadow Password, see “Setting Password Policies for Individual Users” on page 112.<br />
To enable or disable authentication methods for <strong>Open</strong> <strong>Directory</strong> passwords:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to an <strong>Open</strong> <strong>Directory</strong> master server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click Policy.<br />
5 Click Authentication, select the authentication methods you want enabled, and<br />
deselect the authentication methods you want disabled.<br />
6 Click Save.<br />
Replicas of the <strong>Open</strong> <strong>Directory</strong> master inherit the authentication method settings for<br />
<strong>Open</strong> <strong>Directory</strong> passwords in the LDAP directory.<br />
From the Command Line<br />
You can also enable or disable Password <strong>Server</strong> authentication methods for <strong>Open</strong><br />
<strong>Directory</strong> passwords by using the NeST command with the -getprotocols and<br />
-setprotocols arguments in Terminal. For more information, see the <strong>Open</strong> <strong>Directory</strong><br />
chapter of Command-Line <strong>Administration</strong>.<br />
Assigning Administrator Rights for <strong>Open</strong> <strong>Directory</strong><br />
Authentication<br />
Using Workgroup Manager and an administrator account with rights to work with<br />
<strong>Open</strong> <strong>Directory</strong> password settings, you can assign these rights to other user accounts<br />
in the same directory domain.<br />
To assign these rights, your user account must have an <strong>Open</strong> <strong>Directory</strong> password and<br />
privileges to administer user accounts. This requirement protects the security of<br />
passwords stored in the Kerberos KDC and the <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong><br />
database.<br />
To assign administrator rights for <strong>Open</strong> <strong>Directory</strong> authentication to a user account:<br />
1 In Workgroup Manager, open the account, click Advanced, and make sure Password<br />
Type is set to <strong>Open</strong> <strong>Directory</strong> password.<br />
Chapter 6 Managing User Authentication 115
For more information, see “Changing the Password Type to <strong>Open</strong> <strong>Directory</strong>” on<br />
page 108.<br />
2 Click Privileges and choose Full in the <strong>Administration</strong> capabilities pop-up menu.<br />
To restrict the administration capabilities, choose Limited.<br />
3 Click Save.<br />
For more information about setting administrator privileges, see User Management.<br />
Keeping the Primary Administrator’s Passwords in Sync<br />
For <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.3, having different passwords for the primary local<br />
administrator account and the LDAP administrator account (user ID 501) can be<br />
confusing. Therefore, keep the passwords the same. On an <strong>Open</strong> <strong>Directory</strong> server<br />
upgraded from <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> version 10.3, the primary administrator account<br />
normally exists in the server’s local directory domain and in its LDAP directory. This<br />
account was copied from the local directory domain to the LDAP directory when the<br />
<strong>Open</strong> <strong>Directory</strong> master was created with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.3.<br />
Initially both copies of this account have user ID 501, the same name, and the same<br />
password. Each account is an administrator of its directory domain, and both are server<br />
administrators.<br />
When you connect to the server in Workgroup Manager using the account’s common<br />
name and password, you are authenticated for the local directory domain and the<br />
LDAP directory domain.<br />
If you change either password, you will no longer be authenticated for both directory<br />
domains. For example, if you use the local administrator’s password when you connect<br />
to the server in Workgroup Manager, you can make changes only in the local directory<br />
domain. To make changes in the LDAP directory, you must click the lock and<br />
authenticate using the LDAP administrator’s password.<br />
Note: An <strong>Open</strong> <strong>Directory</strong> server created with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong> has different<br />
administrator accounts for its local and LDAP directories. They have different names<br />
and user IDs, so their passwords can be different without causing confusion.<br />
Enabling LDAP Bind Authentication for a User<br />
You can enable the use of LDAP bind authentication for a user account stored in an<br />
LDAP directory domain. When you use this password validation technique, you rely on<br />
the LDAP server that contains the user account to authenticate the user’s password.<br />
Important: If your computer name contains a hyphen, you might not be able to join or<br />
bind to a directory domain such as LDAP or Active <strong>Directory</strong>. To establish binding, use a<br />
computer name that does not contain a hyphen.<br />
116 Chapter 6 Managing User Authentication
To enable LDAP bind user authentication:<br />
1 Make sure the <strong>Mac</strong> <strong>OS</strong> X computer that needs to authenticate the user account has a<br />
connection to the LDAP directory where the user account resides and that the<br />
computer’s search policy includes the LDAP directory connection.<br />
For information about configuring LDAP server connections and the search policy, see<br />
“Using Advanced LDAP Service Settings” on page 133.<br />
2 If you configure an LDAP connection that doesn’t map the password and<br />
authentication authority attributes, bind authentication will occur automatically.<br />
For more information, see “Configuring LDAP Searches and Mappings” on page 146.<br />
3 If you configure the connection to permit clear text passwords, you should also<br />
configure it to use SSL to protect the clear text password while it is in transit.<br />
For more information, see “Changing the Security Policy for an LDAP Connection” on<br />
page 145 and “Changing the Connection Settings for an LDAP <strong>Directory</strong>” on page 144.<br />
Setting Passwords of Exported or Imported Users<br />
When you export user accounts whose password type is <strong>Open</strong> <strong>Directory</strong> or shadow<br />
password, passwords are not exported. This protects the security of the <strong>Open</strong> <strong>Directory</strong><br />
Password <strong>Server</strong> database and shadow password files.<br />
Before importing, you can use a spreadsheet application to open the file of exported<br />
users and set their passwords, which they can change the next time they log in. For<br />
instructions for working with files of exported users, see User Management.<br />
After importing user accounts, you have the following options for setting passwords:<br />
 You can set all imported accounts to use a temporary password, which each user can<br />
change the next time he or she logs in. For more information, see “Resetting the<br />
Passwords of Multiple Users” on page 107.<br />
 You can set the password of each imported user account in the Basic pane of<br />
Workgroup Manager. For more information, see “Changing a User’s Password” on<br />
page 106.<br />
Migrating Passwords From <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.1 or Earlier<br />
User accounts can be migrated from earlier versions of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> by importing<br />
the account records or upgrading the server where they reside.<br />
User accounts created with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.1 or earlier have no authentication<br />
authority attribute but they do have crypt passwords. For compatibility with such user<br />
accounts, <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> assumes that a user account without an authentication<br />
authority attribute has a crypt password.<br />
Chapter 6 Managing User Authentication 117
If you import user accounts from <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.1 or earlier, the user accounts<br />
have no authentication authority attribute. Therefore, these user accounts are initially<br />
configured to have crypt passwords.<br />
If you import these user accounts to the server’s local directory domain, each is<br />
converted from crypt password to shadow password when the user or administrator<br />
changes the password or when the user authenticates to a service that can use a<br />
recoverable authentication method.<br />
For information about importing user accounts, see User Management.<br />
Likewise, if you upgrade from <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.1 or earlier, user accounts created<br />
before upgrading have no authentication authority attribute. After upgrading, these<br />
user accounts are assumed to have crypt passwords.<br />
Although existing crypt passwords can continue to be used after importing or<br />
upgrading, you can change user accounts to have <strong>Open</strong> <strong>Directory</strong> or shadow<br />
passwords.<br />
You can change individual user accounts or multiple user accounts by using Workgroup<br />
Manager. Changing a user account’s password type resets the password. For more<br />
information, see “Changing the Password Type to <strong>Open</strong> <strong>Directory</strong>” on page 108 and<br />
“Changing the Password Type to Shadow Password” on page 110.<br />
Some user accounts created with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.1 or earlier may use<br />
Authentication Manager. It is a legacy technology for authenticating users of Windows<br />
file service and users of <strong>Apple</strong> file service whose <strong>Mac</strong> <strong>OS</strong> 8 computers have not been<br />
upgraded with AFP client software version 3.8.3 or later.<br />
When migrating Authentication Manager users, you have the following options:<br />
 If you upgrade first from <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.1 to v10.2 and then to <strong>v10.5</strong>, existing<br />
users can continue to use their same passwords.<br />
 You can change some or all upgraded user accounts to have <strong>Open</strong> <strong>Directory</strong><br />
passwords or shadow passwords, which are more secure than crypt passwords. For<br />
more information, see <strong>Open</strong> <strong>Directory</strong> <strong>Administration</strong>.<br />
 If the upgraded server has a shared NetInfo domain and you migrate it to an LDAP<br />
directory, all user accounts are converted to <strong>Open</strong> <strong>Directory</strong> passwords.<br />
 Each user account in the server’s local directory domain is converted from crypt<br />
password to shadow password when the user or administrator changes the<br />
password or when the user authenticates to a service that can use a recoverable<br />
authentication method.<br />
 If you import user accounts that use Authentication Manager into the LDAP<br />
directory, they are converted during importing to have <strong>Open</strong> <strong>Directory</strong> passwords.<br />
118 Chapter 6 Managing User Authentication
7 Managing<br />
<strong>Directory</strong> Clients<br />
7<br />
Use <strong>Directory</strong> Utility to configure and manage how a<br />
computer with <strong>Mac</strong> <strong>OS</strong> X or <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> accesses<br />
directory services.<br />
After you configure your directory server, you can connect client computers using<br />
<strong>Directory</strong> Utility. You can use <strong>Directory</strong> Utility to connect to remote computers and<br />
change their settings, simplifying computer management.<br />
Connecting Clients to <strong>Directory</strong> <strong>Server</strong>s<br />
The following sections discuss how to add, remove, edit, and monitor directory servers<br />
in the <strong>Directory</strong> <strong>Server</strong>s list of <strong>Directory</strong> Utility.<br />
 “About <strong>Directory</strong> <strong>Server</strong> Connections” on page 119<br />
 “Automated Client Configuration” on page 120<br />
 “Adding an Active <strong>Directory</strong> <strong>Server</strong> Connection” on page 121<br />
 “Adding an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong> Connection” on page 121<br />
 “Removing a <strong>Directory</strong> <strong>Server</strong> Connection” on page 122<br />
 “Editing a <strong>Directory</strong> <strong>Server</strong> Connection” on page 122<br />
 “Monitoring <strong>Directory</strong> <strong>Server</strong> Connections” on page 123<br />
About <strong>Directory</strong> <strong>Server</strong> Connections<br />
You can use <strong>Directory</strong> Utility to connect computers to directory servers. The <strong>Directory</strong><br />
<strong>Server</strong>s pane in <strong>Directory</strong> Utility lists the directory servers your computer is connected<br />
to. Your <strong>Mac</strong> <strong>OS</strong> X computer accesses the servers in the list for user information and<br />
other administrative data stored in the directory domain of directory servers.<br />
When you add or delete a server in the <strong>Directory</strong> <strong>Server</strong>s list, the entries associated<br />
with that directory server are added or deleted from the Services, Authentication, and<br />
Contacts list. However, if you remove the associated entries within the Services,<br />
Authentication, and Contacts list, the directory server is not removed from the<br />
<strong>Directory</strong> <strong>Server</strong>s list.<br />
119
<strong>Mac</strong> <strong>OS</strong> X <strong>v10.5</strong> computers can connect to an <strong>Open</strong> <strong>Directory</strong>, Active <strong>Directory</strong>, or<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> directory server. If you don’t know which server to connect to, ask<br />
your network administrator.<br />
Important: If your computer name contains a hyphen, you might not be able to join or<br />
bind to a directory domain such as LDAP or Active <strong>Directory</strong>. To establish binding, use a<br />
computer name that does not contain a hyphen.<br />
Automated Client Configuration<br />
When you connect to an <strong>Open</strong> <strong>Directory</strong> domain that is a standard or workgroup<br />
configuration of <strong>Mac</strong> <strong>OS</strong> X server, <strong>Directory</strong> Utility assists you in setting up your<br />
computer.<br />
To connect to a standard or workgroup configuration server:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility (in /Applications/Utilities/).<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 Click <strong>Directory</strong> <strong>Server</strong>s, then click the Add (+) button.<br />
4 From the “Add a new directory of type” pop-up menu, choose <strong>Open</strong> <strong>Directory</strong>.<br />
5 In the “<strong>Server</strong> Name or IP Address” field, enter the server name or IP address.<br />
6 (Conditional) Before you select the “Encrypt using SSL” checkbox, check with your <strong>Open</strong><br />
directory administrator to determine if SSL is needed.<br />
7 In the Introduction pane, a list of services offered by the server you are connecting to<br />
are displayed, click Begin Setup.<br />
8 Enter the Authentication information for the server you are connecting to.<br />
In the name and password field, enter the administrator name and password for the<br />
server you are connecting to.<br />
Enter the password for the user account that appears in “Enter the password for the<br />
account username on this computer.”<br />
9 Click Continue.<br />
10 Under Configuration Options, choose to let <strong>Directory</strong> Utility configure your applications<br />
or not.<br />
Select Yes if you want the server to configure your application to use services that it<br />
offers.<br />
Select No to bypass this configuration.<br />
11 Click Continue.<br />
12 Click Finish Setup.<br />
<strong>Directory</strong> Utility configures your computer.<br />
120 Chapter 7 Managing <strong>Directory</strong> Clients
13 Click Log Out to log out of the computer.<br />
To use the new services, log back in.<br />
Click Don’t Log Out if you want to stay logged in to the server.<br />
Adding an Active <strong>Directory</strong> <strong>Server</strong> Connection<br />
When connecting to an Active <strong>Directory</strong> server, you must know the server name or IP<br />
address and have the Active <strong>Directory</strong> administrator user name and password.<br />
To add an Active <strong>Directory</strong> <strong>Server</strong>:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility (in /Applications/Utilities/).<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 Click the Add (+) button.<br />
4 From the “Add a new directory of type” pop-up menu, choose Active <strong>Directory</strong>, then<br />
enter the following information:<br />
 Active <strong>Directory</strong> Domain: This is the DNS name or IP address of the Active <strong>Directory</strong><br />
server.<br />
 Computer ID: Optionally edit the ID you want Active <strong>Directory</strong> to use for your server.<br />
This is the server’s NetBI<strong>OS</strong> name. The name should contain no more than 15<br />
characters, no special characters, and no punctuation. If practical, make the server<br />
name match its unqualified DNS host name. For example, if your DNS server has an<br />
entry for your server as “server.example.com,” give your server the name “server.”<br />
 AD Administrator Username and Password: Enter the user name and password of the<br />
Active <strong>Directory</strong> administrator.<br />
5 Click OK.<br />
Adding an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong> Connection<br />
When adding an <strong>Open</strong> <strong>Directory</strong> server, you must know the server name or IP address<br />
and whether the server uses secure socket layer (SSL).<br />
To add an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility (in /Applications/Utilities/).<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 Click the Add (+) button.<br />
4 From the “Add a new directory of type” pop-up menu, choose <strong>Open</strong> <strong>Directory</strong>.<br />
5 In the “<strong>Server</strong> Name or IP Address” field, enter the server name or IP address.<br />
6 (Conditional) Before you select the “Encrypt using SSL” checkbox, ask your <strong>Open</strong><br />
directory administrator if SSL is needed.<br />
Chapter 7 Managing <strong>Directory</strong> Clients 121
Important: If you change your IP address and computer name using changeip while<br />
you are connected to a directory server, you must disconnect and reconnect to the<br />
directory server to update the directory with the new computer name and IP address. If<br />
you do not disconnect and reconnect to the directory server, the directory will not<br />
update and will continue to use the old computer name and IP address.<br />
Removing a <strong>Directory</strong> <strong>Server</strong> Connection<br />
Before removing a directory server from <strong>Directory</strong> Utility, make sure you are not using<br />
its services for other applications.<br />
For example, if Mail is configured to use the directory server to search for people and<br />
you delete the directory server, you can’t search for anyone that was on that directory<br />
server.<br />
To delete a <strong>Directory</strong> server:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility (in /Applications/Utilities/).<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 From the <strong>Directory</strong> <strong>Server</strong>s list, select the directory server you want to delete.<br />
4 Click the Delete (–) button.<br />
5 If you are sure you have selected the correct directory server, click Stop Using <strong>Server</strong>.<br />
Editing a <strong>Directory</strong> <strong>Server</strong> Connection<br />
You can use <strong>Directory</strong> Utility to edit directory servers you are connected to.<br />
To edit a <strong>Directory</strong> server connection:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility (in /Applications/Utilities/).<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 From the <strong>Directory</strong> <strong>Server</strong>s list, select the directory server you want to edit.<br />
4 Click the Edit (/) button.<br />
5 Change the directory server settings.<br />
6 Click OK.<br />
122 Chapter 7 Managing <strong>Directory</strong> Clients
Monitoring <strong>Directory</strong> <strong>Server</strong> Connections<br />
You can use the <strong>Directory</strong> <strong>Server</strong>s list of <strong>Directory</strong> Utility to monitor the status of<br />
directory servers your computer is connected to. This information can help when you<br />
are trying to determine why you can’t connect to a specific directory server.<br />
To monitor the status of a <strong>Directory</strong> server:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility (in /Applications/Utilities/).<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 Note the color of the status dot to the left of the directory server:<br />
 Green: The directory server is responding to <strong>Directory</strong> Utility.<br />
 Yellow: <strong>Directory</strong> Utility is waiting for a response from the directory server.<br />
 Red: The directory server is not responding to <strong>Directory</strong> Utility.<br />
Managing the Root User Account<br />
You can use <strong>Directory</strong> Utility to manage the root user account by enabling or disabling<br />
the root user. If you enabled the root user account, you can also use <strong>Directory</strong> Utility to<br />
change the root account password.<br />
Enabling the Root User Account<br />
You can use <strong>Directory</strong> Utility to enable the root user account. If you enable the root<br />
user account, use a well-encrypted password that contains alphanumeric and special<br />
characters, to prevent the password from being compromised.<br />
WARNING: The root account is an unrestricted administrator account used to perform<br />
changes to critical system files. Even if you are logged in as an administrator, you<br />
must still use the root account, or sudo, to perform critical system tasks.<br />
Never use the root account to log in to a computer (remotely or locally). Instead, use<br />
sudo to perform root tasks. You can restrict access to sudo by adding users to the /etc/<br />
sudoers/ file.<br />
For more information about the root account, see User Management.<br />
To enable the root user account:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility (in /Applications/Utilities/).<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 Choose Edit > Enable Root User.<br />
Chapter 7 Managing <strong>Directory</strong> Clients 123
Changing the Root User Account Password<br />
You can use <strong>Directory</strong> Utility to change the root account password. When changing the<br />
root password, use a well-encrypted password that contains alphanumeric and special<br />
characters, to prevent the password from being compromised.<br />
WARNING: The root account is an unrestricted administrator account used to perform<br />
changes to critical system files. Even if you are logged in as an administrator, you<br />
must still use the root account, or sudo, to perform critical system tasks.<br />
Never use the root account to log in to a computer (remotely or locally). Instead, use<br />
sudo to perform root tasks. You can restrict access to sudo by adding users to the /etc/<br />
sudoers/ file.<br />
For more information about the root account, see User Management.<br />
To change the root user account password:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility (in /Applications/Utilities/).<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 Choose Edit > Change Root Password.<br />
4 When prompted, enter the new root password in the Password and Verify fields.<br />
5 Click OK.<br />
124 Chapter 7 Managing <strong>Directory</strong> Clients
8 Advanced<br />
<strong>Directory</strong> Client<br />
Settings<br />
8<br />
Use <strong>Directory</strong> Utility to set up and manage how a computer<br />
with <strong>Mac</strong> <strong>OS</strong> X or <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> accesses directory services.<br />
After you configure your directory server, you can customize the advanced settings of<br />
<strong>Directory</strong> Utility to work with your computer and software applications.<br />
For setup and management task descriptions and instructions, see:<br />
 “Setting Up <strong>Directory</strong> Utility on a Remote <strong>Server</strong>” on page 126<br />
 “Configuring Mount Records for a Computer’s Local <strong>Directory</strong> Domain” on page 126<br />
 “Using Advanced Search Policy Settings” on page 128<br />
 “Using Advanced <strong>Directory</strong> Services Settings” on page 132<br />
 “Using Advanced LDAP Service Settings” on page 133<br />
 “Using Advanced Active <strong>Directory</strong> Service Settings” on page 156<br />
 “Specifying NIS Settings” on page 170<br />
 “Specifying BSD Configuration File Settings” on page 171<br />
About Advanced <strong>Directory</strong> Services Settings<br />
You can use the advanced features of <strong>Directory</strong> Utility to configure NFS mount records,<br />
services, and search policies. You can also use <strong>Directory</strong> Utility to configure a remote<br />
computer.<br />
The following are the advanced features of <strong>Directory</strong> Utility:<br />
 Connect is used to configure a client computer or server remotely.<br />
 Mounts is used to configure NFS mounts that mount when the computer restarts.<br />
 Services is used to configure directory servers that users can access.<br />
 Search Policy is used to configure where the computer searches for user<br />
authentication and contact information.<br />
125
Setting Up <strong>Directory</strong> Utility on a Remote <strong>Server</strong><br />
You can use the <strong>Directory</strong> Utility application on your computer to set up and manage<br />
how <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> on a remote server accesses directory services.<br />
To configure directory access on a remote server:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility on your computer, then from the File menu choose Connect.<br />
2 Enter the following connection and authentication information for the server you want<br />
to configure.<br />
Address: Enter the DNS name or IP address of the server you want to configure.<br />
User Name: Enter the user name of an administrator on the server.<br />
Password: Enter the password for the user name you entered.<br />
3 Click Connect.<br />
4 Click the <strong>Directory</strong> <strong>Server</strong>s, Mounts, Services, and Search Policy tabs and change<br />
settings as needed.<br />
All changes you make affect the remote server that you connected to in the previous<br />
steps.<br />
5 From the File menu on your computer, choose Disconnect.<br />
Configuring Mount Records for a Computer’s Local <strong>Directory</strong><br />
Domain<br />
You can use <strong>Directory</strong> Utility to configure NFS mounts for your computer. NFS mounts<br />
are share points hosted by an NFS server. You can use NFS share points to share<br />
information with a group of users on a network or for a user’s network-based home<br />
folder.<br />
If you use <strong>Directory</strong> Utility to configure NFS mounts on your computer, the mounts will<br />
mount when the computer starts up. NFS mounts are listed in the Mounts pane of<br />
<strong>Directory</strong> Utility. The Mounts pane shows you the NFS URL and the location of the NFS<br />
mounts on the computer.<br />
Adding a Mount Record to the Local <strong>Directory</strong> Domain<br />
When adding an NFS server make sure you have the URL of the NFS server you are<br />
adding and that you have access to the NFS share point.<br />
To add a mount record:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility (in /Applications/Utilities/).<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 Click Show Advanced Settings (if they aren’t visible).<br />
126 Chapter 8 Advanced <strong>Directory</strong> Client Settings
4 Click Mounts, then click the Add (+) button.<br />
5 Enter the setting for the NFS mount by doing the following:<br />
In the “Remote NFS URL” field, enter the NFS URL.<br />
In the “Mount location” field, enter the local mount point for the NFS mount.<br />
To add mount parameters, click the triangle to the left of “Advanced Mount Parameters”<br />
and enter your parameters.<br />
To mount the NFS volume as read only, select the “Mount as read-only” checkbox.<br />
If you want the NFS mount point to ignore user ID privileges, select the “Ignore ‘set user<br />
ID’ privileges” checkbox.<br />
6 To verify that the NFS server is responding, click Verify; otherwise, click Don’t Verify.<br />
If <strong>Directory</strong> Utility receives a response from the NFS server, a prompt indicating a<br />
successful response appears.<br />
If <strong>Directory</strong> Utility does not receive a response from the NFS server, you can create the<br />
mount by clicking Create.<br />
7 Click Apply.<br />
The NFS mounts are visible in the Mounts pane of <strong>Directory</strong> Utility.<br />
Removing a Mount Record from the Local <strong>Directory</strong> Domain<br />
When removing an NFS mount from <strong>Directory</strong> Utility, make sure you don’t delete your<br />
NFS home folder mount record. If you do you will lose access to your data.<br />
To remove a mount record:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility (in /Applications/Utilities/).<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 Click Show Advanced Settings (if they aren’t visible).<br />
4 Click Mounts.<br />
5 From the Mounts list, select the NFS mount you want to delete.<br />
6 Click the Delete (–) button.<br />
7 If you are sure you have selected the correct NFS mount, click Delete.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 127
Editing a Mount Record in the Local <strong>Directory</strong> Domain<br />
You can use <strong>Directory</strong> Utility to change the settings of an existing NFS mount record.<br />
To edit a mount record:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility (in /Applications/Utilities/).<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 Click Show Advanced Settings (if they aren’t visible).<br />
4 Click Mounts.<br />
5 From the Mounts list, select the NFS mount you want to edit.<br />
6 Click the Edit (/) button.<br />
7 Change the NFS mount settings.<br />
Using Advanced Search Policy Settings<br />
<strong>Directory</strong> Utility defines the following search policies:<br />
 Authentication: <strong>Mac</strong> <strong>OS</strong> X uses the authentication search policy to locate and<br />
retrieve user authentication information and other administrative data from directory<br />
domains.<br />
 Contacts: <strong>Mac</strong> <strong>OS</strong> X uses the contacts search policy to locate and retrieve name,<br />
address, and other contact information from directory domains. <strong>Mac</strong> <strong>OS</strong> X Address<br />
Book uses this contact information. Other applications can also be programmed to<br />
use it.<br />
Each search policy consists of a list of directory domains. The order of directory<br />
domains in the list defines the search policy. Starting at the top of the list, <strong>Mac</strong> <strong>OS</strong> X<br />
searches each listed directory domain until it finds the information it needs or reaches<br />
the end of the list without finding the information.<br />
The authentication and contacts search policies can have one of the following settings:<br />
 Automatic: Starts with the local directory domain and can include an LDAP<br />
directory supplied by DHCP and directory domains that the computer is connected<br />
to. This is the default setting for <strong>Mac</strong> <strong>OS</strong> X v10.2 or later and offers the most flexibility<br />
for mobile computers.<br />
 Local directory: Includes only the local directory domain.<br />
 Custom path: Starts with the local directory domain and includes your choice of<br />
LDAP directories, an Active <strong>Directory</strong> domain, shared directory domains, BSD<br />
configuration files, and an NIS domain.<br />
128 Chapter 8 Advanced <strong>Directory</strong> Client Settings
Important: If you configure <strong>Mac</strong> <strong>OS</strong> X to use an automatic authentication search policy<br />
and a DHCP-supplied LDAP server, you increase the risk of a malicious user gaining<br />
control of your computer. The risk is even higher if your computer is configured to<br />
connect to a wireless network. For more information, see “Protecting Computers from a<br />
Malicious DHCP <strong>Server</strong>” on page 131.<br />
For task descriptions and instructions, see:<br />
 “Defining Automatic Search Policies” on page 129<br />
 “Defining Custom Search Policies” on page 130<br />
 “Defining Local <strong>Directory</strong> Search Policies” on page 131<br />
 “Waiting for a Search Policy Change to Take Effect” on page 131<br />
Defining Automatic Search Policies<br />
Using <strong>Directory</strong> Utility, you can configure a <strong>Mac</strong> <strong>OS</strong> X computer’s authentication and<br />
contacts search policies to be defined automatically.<br />
An automatically defined search policy includes the local directory domain. It can also<br />
include an LDAP directory server specified by DHCP service as well as shared directory<br />
domains the computer is connected to.<br />
This is the default configuration for the authentication and contacts search policies.<br />
Note: Some applications, such as <strong>Mac</strong> <strong>OS</strong> X Mail and Address Book, can access LDAP<br />
directories directly, without using <strong>Open</strong> <strong>Directory</strong>. To set up one of these applications<br />
to access LDAP directories directly, open the application and set the correct preference.<br />
Important: If you configure <strong>Mac</strong> <strong>OS</strong> X to use an automatic authentication search policy<br />
and a DHCP-supplied LDAP server or a DHCP-supplied shared directory domain, you<br />
increase the risk of a malicious user gaining control of your computer. The risk is even<br />
higher if your computer is configured to connect to a wireless network. For more<br />
information, see “Protecting Computers from a Malicious DHCP <strong>Server</strong>” on page 131.<br />
To have a search policy defined automatically:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility, click Search Policy, and choose a search policy:<br />
 Authentication: Shows the search policy used for authentication and most other<br />
administrative data.<br />
 Contacts: Shows the search policy used for contact information in applications such<br />
as Address Book.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 From the Search pop-up menu, choose Automatic, then click Apply.<br />
4 In System Preferences, make sure the computer’s Network preferences are configured<br />
to use DHCP or DHCP with a manual IP address.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 129
5 To include an LDAP server in the automatic search policy, make sure the use of a<br />
DHCP-supplied LDAP directory is enabled in <strong>Directory</strong> Utility and that the DHCP service<br />
is configured to supply the LDAP server’s address.<br />
For more information, see “Enabling or Disabling Use of a DHCP-Supplied LDAP<br />
<strong>Directory</strong>” on page 134. For information about configuring the DHCP service of<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>, see Network Services <strong>Administration</strong>.<br />
Defining Custom Search Policies<br />
Using <strong>Directory</strong> Utility, you can configure a <strong>Mac</strong> <strong>OS</strong> X computer’s authentication and<br />
contacts search policies to use a custom list of directory domains.<br />
A custom list starts with the computer’s local directory domain and can include <strong>Open</strong><br />
<strong>Directory</strong> (and other LDAP directory domains), an Active <strong>Directory</strong> domain, shared<br />
directory domains, BSD configuration files, and an NIS domain.<br />
If a directory domain specified on a computer’s custom search policy is not available, a<br />
delay occurs when the computer starts up.<br />
To specify a custom list of directory domains for a search policy:<br />
1 In <strong>Directory</strong> Utility, click Search Policy, and choose a search policy.<br />
 Authentication: Shows the search policy used for authentication and most other<br />
administrative data.<br />
 Contacts: Shows the search policy used for contact information in applications such<br />
as Address Book.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 From the Search pop-up menu, choose “Custom path.”<br />
4 Add directory domains as needed by clicking Add, selecting one or more directories,<br />
and clicking Add again.<br />
5 Change the order of the listed directory domains as needed by dragging them up or<br />
down the list.<br />
6 Remove listed directory domains that you don’t want in the search policy by selecting<br />
them and clicking the Delete (–) button.<br />
7 Confirm the removal by clicking OK, then click Apply.<br />
To add a directory that isn’t listed among the available directories, make sure the<br />
computer has been configured to access the directory. For more information, see:<br />
 “Using Advanced <strong>Directory</strong> Services Settings” on page 132<br />
 “Using Advanced LDAP Service Settings” on page 133<br />
 “Using Advanced Active <strong>Directory</strong> Service Settings” on page 156<br />
 “Specifying NIS Settings” on page 170<br />
130 Chapter 8 Advanced <strong>Directory</strong> Client Settings
 “Specifying BSD Configuration File Settings” on page 171<br />
Defining Local <strong>Directory</strong> Search Policies<br />
Using <strong>Directory</strong> Utility, you can configure a <strong>Mac</strong> <strong>OS</strong> X computer’s authentication and<br />
contacts search policies to use only the computer’s local directory.<br />
A search policy that uses only the local directory limits the access that a computer has<br />
to authentication information and other administrative data.<br />
If you restrict a computer’s authentication search policy to use only the local directory,<br />
only users with local accounts can log in.<br />
To have a search policy use only the local directory domain (local directory):<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility, click Search Policy, and choose a search policy:<br />
 Authentication: Shows the search policy used for authentication and most other<br />
administrative data.<br />
 Contacts: Shows the search policy used for contact information in applications such<br />
as Address Book.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 From the Search pop-up menu, choose “Local directory,” then click Apply.<br />
Waiting for a Search Policy Change to Take Effect<br />
After changing the search policy in the Authentication pane or the Contacts pane of<br />
<strong>Directory</strong> Utility, wait 10 or 15 seconds for the change to take effect. Attempts to log in<br />
using an account from a directory domain that uses the authentication search policy<br />
are unsuccessful until changes to it take effect.<br />
Protecting Computers from a Malicious DHCP <strong>Server</strong><br />
<strong>Apple</strong> recommends that you don’t use an automatic authentication search policy with<br />
a DHCP-supplied LDAP server or a DHCP-supplied shared directory domain in an<br />
environment where security is a major concern.<br />
A malicious hacker with access to your network can use a sham DHCP server and a<br />
sham LDAP directory (or shared directory domain) to control your computer by using<br />
the root user account.<br />
For a hacker to access your network, the hacker’s sham DHCP server must be part of<br />
your local network or subnet. Therefore, if your computers are the only ones on your<br />
local network and they get Internet access through <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> NAT service or a<br />
NAT router, this type of security breach is not possible. However, a wireless local<br />
network decreases security because a hacker can join a wireless local network more<br />
easily than a wired local network.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 131
You can protect your <strong>Mac</strong> against malicious attacks from a sham DHCP server by<br />
disabling use of a DHCP-supplied LDAP directory and disabling broadcast and DHCP<br />
binding for local directory domain (or disabling the local directory domain). For more<br />
information, see “Enabling or Disabling Use of a DHCP-Supplied LDAP <strong>Directory</strong>” on<br />
page 134.<br />
If you have a mobile computer that connects to an LDAP server when the computer is<br />
connected to a network, and you change the computer’s search policy from automatic<br />
to custom (in the Authentication pane of Search Policy in <strong>Directory</strong> Utility), a startup<br />
delay occurs when the computer is not connected to the network.<br />
The delay occurs because the computer can’t connect to a specific directory domain<br />
listed in the computer’s custom search policy. No delay is noticeable when waking a<br />
computer that’s been disconnected from the network while sleeping.<br />
Using Advanced <strong>Directory</strong> Services Settings<br />
<strong>Directory</strong> Utility lists the different kinds of directory services that <strong>Mac</strong> <strong>OS</strong> X can access.<br />
The list includes directory services, which give <strong>Mac</strong> <strong>OS</strong> X access to user information and<br />
other administrative data stored in directory domains.<br />
You can enable or disable access to each directory service. If you disable a service in<br />
<strong>Directory</strong> Utility, <strong>Mac</strong> <strong>OS</strong> X no longer accesses that directory service.<br />
For task descriptions and instructions, see:<br />
 “Enabling or Disabling Active <strong>Directory</strong> Service” on page 132<br />
 “Enabling or Disabling LDAP <strong>Directory</strong> Services” on page 133<br />
Enabling or Disabling Active <strong>Directory</strong> Service<br />
You can use <strong>Directory</strong> Utility to enable or disable the use of Active <strong>Directory</strong> services<br />
provided by a Windows server. Active <strong>Directory</strong> is the directory service of Windows<br />
2000 and later servers.<br />
If you disable Active <strong>Directory</strong> services and Active <strong>Directory</strong> domains are part of a<br />
custom search policy, they are listed in red in the Authentication or Contacts pane of<br />
Search Policy in <strong>Directory</strong> Utility.<br />
To enable or disable access to Active <strong>Directory</strong>:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 Next to Active <strong>Directory</strong>, select or deselect the checkbox and click Apply.<br />
For configuration instructions, see “Using Advanced Active <strong>Directory</strong> Service Settings”<br />
on page 156.<br />
132 Chapter 8 Advanced <strong>Directory</strong> Client Settings
Enabling or Disabling LDAP <strong>Directory</strong> Services<br />
You can use <strong>Directory</strong> Utility to enable or disable access to directory services that use<br />
LDAP versions 2 and 3. A single <strong>Directory</strong> Utility plug-in named LDAPv3 provides access<br />
to both LDAP versions 2 and 3.<br />
The directory services provided by <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> use LDAPv3, as do many other<br />
servers. LDAPv3 is an open standard common in mixed networks of <strong>Mac</strong>intosh, UNIX,<br />
and Windows systems. Some servers use the older version, LDAPv2, to provide<br />
directory service.<br />
If you disable LDAP directory services and LDAP directories are part of a custom search<br />
policy, they are listed in red in the Authentication or Contacts pane of Search Policy in<br />
<strong>Directory</strong> Utility.<br />
To enable or disable LDAP directory services:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 Next to LDAPv3, select or deselect the checkbox and click Apply.<br />
For configuration instructions, see “Using Advanced LDAP Service Settings” on<br />
page 133.<br />
Using Advanced LDAP Service Settings<br />
You can configure a server with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> or a computer with <strong>Mac</strong> <strong>OS</strong> X to<br />
access specific LDAP directories, including the LDAP directory of a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
<strong>Open</strong> <strong>Directory</strong> master.<br />
For task descriptions and instructions, see:<br />
 “Accessing LDAP Directories in Mail and Address Book” on page 134<br />
 “Enabling or Disabling Use of a DHCP-Supplied LDAP <strong>Directory</strong>” on page 134<br />
 “Showing or Hiding Configurations for LDAP <strong>Server</strong>s” on page 135<br />
 “Configuring Access to an LDAP <strong>Directory</strong>” on page 136<br />
 “Configuring Access to an LDAP <strong>Directory</strong> Manually” on page 138<br />
 “Changing a Configuration for Accessing an LDAP <strong>Directory</strong>” on page 140<br />
 “Duplicating a Configuration for Accessing an LDAP <strong>Directory</strong>” on page 141<br />
 “Deleting a Configuration for Accessing an LDAP <strong>Directory</strong>” on page 143<br />
 “Changing the Connection Settings for an LDAP <strong>Directory</strong>” on page 144<br />
 “Changing the Security Policy for an LDAP Connection” on page 145<br />
 “Configuring LDAP Searches and Mappings” on page 146<br />
 “Setting Up Trusted Binding for an LDAP <strong>Directory</strong>” on page 149<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 133
 “Stopping Trusted Binding with an LDAP <strong>Directory</strong>” on page 150<br />
 “Changing the <strong>Open</strong>/Close Timeout for an LDAP Connection” on page 150<br />
 “Changing the Query Timeout for an LDAP Connection” on page 151<br />
 “Changing the Rebind-Try Delay Time for an LDAP Connection” on page 151<br />
 “Changing the Idle Timeout for an LDAP Connection” on page 152<br />
 “Forcing Read-Only LDAPv2 Access” on page 152<br />
 “Ignoring LDAP <strong>Server</strong> Referrals” on page 152<br />
 “Authenticating an LDAP Connection” on page 153<br />
 “Changing the Password Used for Authenticating an LDAP Connection” on page 153<br />
 “Mapping Config Record Attributes for LDAP Directories” on page 154<br />
 “Editing RFC 2307 Mapping to Enable Creating Users” on page 154<br />
 “Preparing a Read-Only LDAP <strong>Directory</strong> for <strong>Mac</strong> <strong>OS</strong> X” on page 155<br />
 “Populating LDAP Directories with Data for <strong>Mac</strong> <strong>OS</strong> X” on page 155<br />
Accessing LDAP Directories in Mail and Address Book<br />
You can configure <strong>Mac</strong> <strong>OS</strong> X Mail, Address Book, and some similar applications to<br />
access specific LDAP directories directly, without using <strong>Open</strong> <strong>Directory</strong>.<br />
For more information, open Mail and choose Help > Mail Help or open Address Book<br />
and choose Help > Address Book Help; then search for help on LDAP.<br />
Enabling or Disabling Use of a DHCP-Supplied LDAP <strong>Directory</strong><br />
Using <strong>Directory</strong> Utility, you can configure a <strong>Mac</strong> <strong>OS</strong> X computer to get the address of<br />
an LDAP directory server when the computer starts up.<br />
<strong>Mac</strong> <strong>OS</strong> X requests the address of an LDAP directory server from the DHCP service that<br />
also supplies the computer’s IP address, router address, and DNS server addresses.<br />
<strong>Mac</strong> <strong>OS</strong> X adds the LDAP server’s address supplied by DHCP to the computer’s<br />
automatic search policy. The DHCP-supplied LDAP server also appears (dimmed) in the<br />
list of LDAP configurations.<br />
For more information, see “Defining Automatic Search Policies” on page 129 and<br />
“Changing a Configuration for Accessing an LDAP <strong>Directory</strong>” on page 140.<br />
The computer can’t be configured to use both a trusted LDAP binding and a DHCPsupplied<br />
LDAP directory. Trusted LDAP binding is inherently a static binding, but DHCPsupplied<br />
LDAP is a dynamic binding.<br />
For more information, see “Setting Up Trusted Binding for an LDAP <strong>Directory</strong>” on<br />
page 149 and “Setting a Binding Policy for an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>” on page 184.<br />
134 Chapter 8 Advanced <strong>Directory</strong> Client Settings
Important: If you configure <strong>Mac</strong> <strong>OS</strong> X to use an automatic authentication search policy<br />
and a DHCP-supplied LDAP server or a DHCP-supplied shared directory domain, you<br />
increase the risk of a malicious user gaining control of your computer. The risk is even<br />
higher if your computer is configured to connect to a wireless network. For more<br />
information, see “Protecting Computers from a Malicious DHCP <strong>Server</strong>” on page 131.<br />
To enable or disable automatic access to an LDAP server:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3, then click the Edit (/) button.<br />
4 From the Location pop-up menu, choose a network location.<br />
The DHCP-supplied LDAP option can be enabled or disabled independently for each<br />
network location defined in the Network pane of System Preferences.<br />
5 Click “Add DHCP-supplied LDAP servers to automatic search policies” and do one of the<br />
following:<br />
 If you disable this setting, this computer won’t use an LDAP directory server supplied<br />
by DHCP. For more information, see “Configuring Access to an LDAP <strong>Directory</strong>” on<br />
page 136.<br />
 If you enable this setting, configure the server that provides this computer with<br />
DHCP service to supply the address of an LDAP directory server. For more<br />
information, see the DHCP chapter of Network Services <strong>Administration</strong>.<br />
Showing or Hiding Configurations for LDAP <strong>Server</strong>s<br />
You can show or hide a list of available configurations for accessing LDAP directories.<br />
Each configuration specifies how <strong>Open</strong> <strong>Directory</strong> accesses an LDAP directory. When the<br />
list is visible, you can change settings for each LDAP configuration that isn’t dimmed.<br />
When an LDAP configuration is dimmed, the configuration is supplied by DHCP, as<br />
described in “Enabling or Disabling Use of a DHCP-Supplied LDAP <strong>Directory</strong>” on<br />
page 134.<br />
To show or hide available LDAP directory configurations:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 Click the Show Options control or the Hide Options control, whichever is present.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 135
Configuring Access to an LDAP <strong>Directory</strong><br />
Using <strong>Directory</strong> Utility, you can specify how <strong>Mac</strong> <strong>OS</strong> X accesses an LDAPv3 directory if<br />
you know the DNS name or IP address of the LDAP directory server.<br />
If the directory is not hosted by a server that supplies its own mappings (such as<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>) you must know the search base and the template for mapping<br />
<strong>Mac</strong> <strong>OS</strong> X data to the directory’s data.<br />
Supported mapping templates are:<br />
 <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>, for a directory that uses the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> schema<br />
 Active <strong>Directory</strong>, for a directory hosted by a Windows 2000, Windows 2003, or later<br />
server<br />
 RFC 2307, for most directories hosted by UNIX servers<br />
The LDAPv3 plug-in fully supports <strong>Open</strong> <strong>Directory</strong> replication and failover. If the <strong>Open</strong><br />
<strong>Directory</strong> master becomes unavailable, the plug-in falls back to a nearby replica.<br />
To specify custom mappings for the directory data, follow the instructions in<br />
“Configuring Access to an LDAP <strong>Directory</strong> Manually” on page 138 instead of the<br />
instructions here.<br />
Important: If your computer name contains a hyphen, you might not be able to join or<br />
bind to a <strong>Directory</strong> Domain such as LDAP or Active <strong>Directory</strong>. To establish binding, use<br />
a computer name that does not contain a hyphen.<br />
To have <strong>Directory</strong> Utility help you configure access to an LDAP directory:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
You can select LDAPv3 in the list of services without selecting the Enable checkbox for<br />
LDAPv3.<br />
4 Click New and enter the LDAP server’s DNS name or IP address.<br />
5 Select the options for accessing the directory:<br />
 Select “Encrypt using SSL” if you want <strong>Open</strong> <strong>Directory</strong> to use Secure Sockets Layer<br />
(SSL) for connections with the LDAP directory. Before you select this, ask your <strong>Open</strong><br />
<strong>Directory</strong> administrator to determine if SSL is needed.<br />
 Select “Use for authentication” if this directory contains user accounts that someone<br />
will use to log in or authenticate to services.<br />
 Select “Use for contacts” if this directory contains mail addresses and other<br />
information you want to use in Address Book.<br />
136 Chapter 8 Advanced <strong>Directory</strong> Client Settings
If <strong>Directory</strong> Utility can’t contact the LDAP server, a message appears and you must<br />
configure access manually or cancel the setup process. For more information about<br />
manual configuration instructions, see “Configuring Access to an LDAP <strong>Directory</strong><br />
Manually” on page 138.<br />
If the dialog expands to show mapping options, choose the mapping template from<br />
the pop-up menu, enter the search base suffix, and then click Continue.<br />
Typically, the search base suffix is derived from the server’s DNS name. For example, the<br />
search base suffix could be “dc=ods,dc=example,dc=com” for a server whose DNS<br />
name is ods.example.com.<br />
If no available mapping templates apply to the connection you’re setting up, click<br />
Manual. For more information, see “Configuring Access to an LDAP <strong>Directory</strong> Manually”<br />
on page 138.<br />
6 To have <strong>Directory</strong> Utility get information from the LDAP server, click Continue.<br />
7 If the dialog expands to display options for trusted binding, enter the name of the<br />
computer and the name and password of a directory administrator (the binding might<br />
be optional).<br />
The dialog tells you whether the LDAP directory requires trusted binding or makes it<br />
optional. Trusted binding is mutual: each time the computer connects to the LDAP<br />
directory, they authenticate each other. If trusted binding is set up or the LDAP<br />
directory doesn’t support trusted binding, the Bind button does not appear.Make sure<br />
you supplied the correct computer name.<br />
If you see an alert saying that a computer record exists, click Cancel to go back and<br />
change the computer name, or click Overwrite to replace the existing computer record.<br />
The existing computer record might be abandoned, or it might belong to another<br />
computer.<br />
If you replace an existing computer record, notify the LDAP directory administrator in<br />
case replacing the record disables another computer. In this case, the LDAP directory<br />
administrator must give the disabled computer a different name and add it back to the<br />
computer group it belonged to.<br />
For more information about adding a computer to a computer group, see the<br />
computer groups chapter of User Management.<br />
8 If the dialog expands to display connection options, select “Use authentication when<br />
selecting” and enter the distinguished name and password of a user account in the<br />
directory.<br />
The options for an authenticated connection appear if the LDAP server supports an<br />
authenticated connection but not trusted binding. An authentication connection is not<br />
mutual: the LDAP server authenticates the client but the client doesn’t authenticate<br />
the server.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 137
“Use authentication when selecting” is preselected but dimmed if the LDAP server<br />
requires you to enter a user account’s distinguished name and password for an<br />
authenticated connection.<br />
The distinguished name can specify any user account that has permission to see data<br />
in the directory. For example, a user account whose short name is dirauth on an LDAP<br />
server whose address is ods.example.com would have the distinguished name<br />
uid=dirauth,cn=users,dc=ods,dc=example,dc=com.<br />
Important: If the distinguished name or password are incorrect, you can log in to the<br />
computer using user accounts from the LDAP directory.<br />
9 Click OK to finish creating the LDAP connection.<br />
10 Click OK to finish configuring LDAPv3 options.<br />
If you selected “Use for authentication” or “Use for contacts” in step 5, the LDAP<br />
directory configuration you created is added to a custom search policy in the<br />
Authentication or Contacts pane of <strong>Directory</strong> Utility.<br />
Make sure LDAPv3 is enabled in the Services pane so the computer will use the LDAP<br />
configuration you created. For more information, see “Enabling or Disabling LDAP<br />
<strong>Directory</strong> Services” on page 133.<br />
Configuring Access to an LDAP <strong>Directory</strong> Manually<br />
You can manually create a configuration that specifies how <strong>Mac</strong> <strong>OS</strong> X accesses an<br />
LDAPv3 or LDAPv2 directory. You must know the DNS name or IP address of the LDAP<br />
directory server.<br />
If the directory is not hosted by <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>, you must know the search base and<br />
the template for mapping <strong>Mac</strong> <strong>OS</strong> X data to the directory’s data. The supported<br />
mapping templates are:<br />
 From <strong>Server</strong>, for a directory that supplies its own mappings and search base, such as<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
 <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>, for a directory that uses the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> schema<br />
 Active <strong>Directory</strong>, for a directory hosted by a Windows 2000, Windows 2003, or later<br />
server<br />
 RFC 2307, for most directories hosted by UNIX servers<br />
 Custom, for directories that don’t use any of the above mappings<br />
The LDAPv3 plug-in fully supports <strong>Open</strong> <strong>Directory</strong> replication and failover. If the <strong>Open</strong><br />
<strong>Directory</strong> master becomes unavailable, the plug-in falls back to a nearby replica.<br />
Important: If your computer name contains a hyphen, you might not be able to join or<br />
bind to a <strong>Directory</strong> Domain such as LDAP or Active <strong>Directory</strong>. To establish binding, use<br />
a computer name that does not contain a hyphen.<br />
138 Chapter 8 Advanced <strong>Directory</strong> Client Settings
To manually configure access to an LDAP directory:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
You can select LDAPv3 in the list of services without selecting the Enable checkbox for<br />
LDAPv3.<br />
4 Click New, then click Manual.<br />
5 Enter a name for the configuration.<br />
6 Press Tab and enter the DNS name or IP address of the server that hosts the LDAP<br />
directory you want to access.<br />
7 Next to the DNS name or IP address, click the pop-up menu and choose a mapping<br />
template or method:<br />
 If you choose From <strong>Server</strong>, a search base suffix is not needed. In this case, <strong>Open</strong><br />
<strong>Directory</strong> assumes the search base suffix is the first level of the LDAP directory.<br />
 If you choose a template, enter the search base suffix for the LDAP directory and<br />
click OK. You must enter a search base suffix or the computer can’t find information<br />
in the LDAP directory. Typically, the search base suffix is derived from the server’s<br />
DNS name. For example, the search base suffix could be<br />
“dc=ods,dc=example,dc=com” for a server whose DNS name is ods.example.com.<br />
 If you choose Custom, you must set up mappings between <strong>Mac</strong> <strong>OS</strong> X record types<br />
and attributes and the classes and attributes of the LDAP directory you’re connecting<br />
to. For more information, see “Configuring LDAP Searches and Mappings” on<br />
page 146.<br />
8 Before you select the “Encrypt using SSL” checkbox, check with your <strong>Open</strong> <strong>Directory</strong><br />
administrator to determine if SSL is needed.<br />
9 To change the following settings for this LDAP configuration, click Edit to display the<br />
options for the selected LDAP configuration, make changes, and click OK when you<br />
finish editing the LDAP configuration options.<br />
 Click Connection to set timeout options, specify a custom port, ignore server<br />
referrals, or force use of the LDAPv2 (read-only) protocol. For more information, see<br />
“Changing the Connection Settings for an LDAP <strong>Directory</strong>” on page 144.<br />
 Click Search & Mappings to set up searches and mappings for an LDAP server. For<br />
more information, see “Setting Up Trusted Binding for an LDAP <strong>Directory</strong>” on<br />
page 149.<br />
 Click Security to set up an authenticated connection (instead of trusted binding) and<br />
other security policy options. For more information, see “Changing the Security<br />
Policy for an LDAP Connection” on page 145.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 139
 Click Bind to set up trusted bindings (if the LDAP directory supports it). For more<br />
information, see “Setting Up Trusted Binding for an LDAP <strong>Directory</strong>” on page 149.<br />
10 Click OK to finish manually creating the configuration to access an LDAP directory.<br />
11 If you want the computer to access the LDAP directory you created a configuration for,<br />
add the directory to a custom search policy in the Authentication pane and the<br />
Contacts pane of Search Policy in <strong>Directory</strong> Utility, then make sure LDAPv3 is enabled<br />
in the Services pane.<br />
For more information, see “Enabling or Disabling LDAP <strong>Directory</strong> Services” on page 133<br />
and “Defining Custom Search Policies” on page 130.<br />
Note: Before you can use Workgroup Manager to create users on a non-<strong>Apple</strong> LDAP<br />
server that uses RFC 2307 (UNIX) mappings, you must edit the mapping of the Users<br />
record type. For more information, see “Editing RFC 2307 Mapping to Enable Creating<br />
Users” on page 154.<br />
Important: If you change your IP address and computer name using changeip while<br />
you are connected to a directory server you must disconnect and reconnect to the<br />
directory server to update the directory with the new computer name and IP address. If<br />
you do not disconnect and reconnect to the directory server the directory will not<br />
update and will continue to use the old computer name and IP address.<br />
Changing a Configuration for Accessing an LDAP <strong>Directory</strong><br />
You can use <strong>Directory</strong> Utility to change the settings of an LDAP directory configuration.<br />
The configuration settings specify how <strong>Open</strong> <strong>Directory</strong> accesses an LDAPv3 or LDAPv2<br />
directory.<br />
If the LDAP configuration was provided by DHCP, it can’t be changed, so this type of<br />
configuration is dimmed in the LDAP configurations list.<br />
To edit a configuration for accessing an LDAP directory:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 Make changes as needed to the following settings:<br />
 Enable: Click a checkbox to enable or disable access to an LDAP directory server.<br />
 Configuration Name: Double-click a configuration name to edit it.<br />
 <strong>Server</strong> Name or IP Address: Double-click a server name or IP address to change it.<br />
 LDAP Mapping: From the pop-up menu, choose a template, enter the search base<br />
suffix for the LDAP directory, and click OK.<br />
140 Chapter 8 Advanced <strong>Directory</strong> Client Settings
If you chose a template, you must enter a search base suffix or the computer can’t<br />
find information in the LDAP directory. Typically, the search base suffix is derived<br />
from the server’s DNS name. For example, for a server whose DNS name is<br />
ods.example.com the search base suffix is “dc=ods,dc=example,dc=com.”<br />
If you choose From <strong>Server</strong> instead of a template, a search base suffix is not needed.<br />
In this case, <strong>Open</strong> <strong>Directory</strong> assumes the search base suffix is the first level of the<br />
LDAP directory.<br />
If you choose Custom, you must set up mappings between the <strong>Mac</strong> <strong>OS</strong> X record<br />
types and attributes and the classes and attributes of the LDAP directory you’re<br />
connecting to. For more information, see “Configuring LDAP Searches and Mappings”<br />
on page 146.<br />
 SSL: Click the checkbox to enable or disable encrypted communications using the<br />
SSL protocol. Before you select the SSL checkbox, ask your <strong>Open</strong> <strong>Directory</strong><br />
administrator if SSL is needed.<br />
6 To change the following default settings for this LDAP configuration, click Edit to<br />
display the options for the selected LDAP configuration, make changes, and click OK<br />
when you finish editing the LDAP configuration options.<br />
 Click Connection to set timeout options, specify a custom port, ignore server<br />
referrals, or force use of the LDAPv2 (read-only) protocol. For more information, see<br />
“Changing the Connection Settings for an LDAP <strong>Directory</strong>” on page 144.<br />
 Click Search & Mappings to set up searches and mappings for an LDAP server. For<br />
more information, see “Setting Up Trusted Binding for an LDAP <strong>Directory</strong>” on<br />
page 149.<br />
 Click Security to set up an authenticated connection (instead of trusted binding) and<br />
other security policy options. For more information, see “Changing the Security<br />
Policy for an LDAP Connection” on page 145.<br />
 Click Bind to set up trusted binding, or click Unbind to stop trusted binding. (You<br />
may not see these buttons if the LDAP directory doesn’t permit trusted binding.) For<br />
more information, see “Setting Up Trusted Binding for an LDAP <strong>Directory</strong>” on<br />
page 149.<br />
7 To finish changing the configuration to access an LDAP directory, click OK.<br />
Duplicating a Configuration for Accessing an LDAP <strong>Directory</strong><br />
You can use <strong>Directory</strong> Utility to duplicate a configuration that specifies how <strong>Mac</strong> <strong>OS</strong> X<br />
accesses an LDAPv3 or LDAPv2 directory. After duplicating an LDAP directory<br />
configuration, you can change its settings to make it different from the original<br />
configuration.<br />
To duplicate a configuration for accessing an LDAP directory:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 141
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 In the list, select a server configuration and then click Duplicate.<br />
6 Change the duplicate configuration’s settings:<br />
 Enable: Click a checkbox to enable or disable access to an LDAP directory server.<br />
 Configuration Name: Double-click a configuration name to edit it.<br />
 <strong>Server</strong> Name or IP Address: Double-click a server name or IP address to change it.<br />
 LDAP Mapping: Choose a template from the pop-up menu, then enter the search<br />
base suffix for the LDAP directory and click OK.<br />
If you chose a template, you must enter a search base suffix or the computer can’t<br />
find information in the LDAP directory. Typically, the search base suffix is derived<br />
from the server’s DNS name. For example, for a server whose DNS name is<br />
ods.example.com the search base suffix is “dc=ods,dc=example,dc=com.”<br />
If you choose From <strong>Server</strong> instead of a template, a search base suffix is not needed.<br />
In this case, <strong>Open</strong> <strong>Directory</strong> assumes the search base suffix is the first level of the<br />
LDAP directory.<br />
If you choose Custom, you must set up mappings between the <strong>Mac</strong> <strong>OS</strong> X record<br />
types and attributes and the classes and attributes of the LDAP directory you’re<br />
connecting to. For more information, see “Configuring LDAP Searches and Mappings”<br />
on page 146.<br />
 SSL: Click the checkbox to enable or disable encrypted communications using the<br />
SSL protocol. Before you select the SSL checkbox, ask your <strong>Open</strong> <strong>Directory</strong><br />
administrator if SSL is needed.<br />
7 To change the following default settings for the duplicate LDAP configuration, click Edit<br />
to display the options, make changes, and click OK when you finish editing them:<br />
 Click Connection to set up trusted binding (if the LDAP directory supports it), set<br />
timeout options, specify a custom port, ignore server referrals, or force use of the<br />
LDAPv2 (read-only) protocol. For more instructions, see “Changing the Connection<br />
Settings for an LDAP <strong>Directory</strong>” on page 144.<br />
 Click Search & Mappings to set up searches and mappings for an LDAP server. For<br />
more information, see “Setting Up Trusted Binding for an LDAP <strong>Directory</strong>” on<br />
page 149.<br />
 Click Security to set up an authenticated connection (instead of trusted binding) and<br />
other security policy options. For more information, see “Changing the Security<br />
Policy for an LDAP Connection” on page 145.<br />
142 Chapter 8 Advanced <strong>Directory</strong> Client Settings
 Click Bind to set up trusted binding, or click Unbind to stop trusted binding. (You<br />
may not see these buttons if the LDAP directory doesn’t permit trusted binding.) For<br />
more information, see “Setting Up Trusted Binding for an LDAP <strong>Directory</strong>” on<br />
page 149.<br />
8 To finish changing the duplicate configuration, click OK.<br />
9 If you want the computer to access the LDAP directory specified by the duplicate<br />
configuration you created, add the directory to a custom search policy in the<br />
Authentication or Contacts pane of Search Policy in <strong>Directory</strong> Utility and make sure<br />
LDAPv3 is enabled in the Services pane.<br />
For more information, see “Enabling or Disabling LDAP <strong>Directory</strong> Services” on page 133,<br />
and “Defining Custom Search Policies” on page 130.<br />
Deleting a Configuration for Accessing an LDAP <strong>Directory</strong><br />
You can use <strong>Directory</strong> Utility to delete a configuration that specifies how the computer<br />
accesses an LDAPv3 or LDAPv2 directory.<br />
If the LDAP configuration was provided by DHCP, it can’t be changed, so this<br />
configuration option is dimmed in the LDAP configurations list.<br />
To delete a configuration for accessing an LDAP directory:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 In the list, select a server configuration and click Delete, then click OK.<br />
If you see an alert saying the computer is bound to the LDAP directory and you want to<br />
stop trusted binding, click OK and then enter the name and password of an LDAP<br />
directory administrator (not a local computer administrator).If you see an alert saying<br />
the computer can’t contact the LDAP server, you can click OK to forcibly stop trusted<br />
binding.<br />
If you forcibly stop trusted binding, this computer still has a computer record in the<br />
LDAP directory. Notify the LDAP directory administrator so the administrator knows to<br />
remove the computer from the computer group.<br />
For more information about removing a computer from its computer group, see the<br />
computer groups chapter of User Management.<br />
The deleted configuration is removed from the custom search policies for<br />
authentication and contacts.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 143
Changing the Connection Settings for an LDAP <strong>Directory</strong><br />
You can use <strong>Directory</strong> Utility to change the connection settings of a configuration that<br />
specifies how the computer accesses an LDAPv3 or LDAPv2 directory.<br />
To change the connection settings for accessing an LDAP directory:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 In the list, select a server configuration and click Edit.<br />
6 Click Connection and change any of the following settings:<br />
 Configuration Name: Identifies this configuration in the list of LDAP directory<br />
configurations. (You can also change the name in the list of LDAP directory<br />
configurations.)<br />
 <strong>Server</strong> Name or IP Address: Specifies the server’s DNS name or its IP address. (You<br />
can also change this in the list of LDAP directory configurations.)<br />
 <strong>Open</strong>/close times out in: Specifies the maximum length of time a connection<br />
attempt can last before the attempt is cancelled.<br />
 Query times out in: Specifies the maximum length of time a query can last before<br />
the query is cancelled.<br />
 Re-bind attempted in: Specifies the number of seconds to wait before attempting to<br />
reconnect if the LDAP server fails to respond. To prevent continuous reconnection<br />
attempts, increase this value.<br />
 Connection idles out in: Specifies the number of minutes to permit an idle or<br />
unresponsive connection to remain open.<br />
 Encrypt using SSL: Determines whether to encrypt communications with the LDAP<br />
directory by using an SSL connection. (You can also change this setting in the list of<br />
LDAP directory configurations.) Before you select the SSL checkbox, ask your <strong>Open</strong><br />
<strong>Directory</strong> administrator if SSL is needed.<br />
 Use custom port: Specifies a port number other than the standard port for LDAP<br />
connections (389 without SSL, 636 with SSL).<br />
 Ignore server referrals: Determines whether to ignore or follow an LDAP server’s<br />
referral to look on other LDAP servers or replicas for information. <strong>Server</strong> referrals can<br />
help a computer find information but can also delay logins or cause other delays if<br />
the computer must verify referrals to other LDAP servers.<br />
 Use LDAPv2 (read only): Determines whether to use the older LDAPv2 protocol for<br />
read-only access to an LDAP directory.<br />
144 Chapter 8 Advanced <strong>Directory</strong> Client Settings
Changing the Security Policy for an LDAP Connection<br />
Using <strong>Directory</strong> Utility, you can configure a stricter security policy for an LDAPv3<br />
connection than the security policy of the LDAP directory. For example, if the LDAP<br />
directory’s security policy permits clear-text passwords, you can set an LDAPv3<br />
connection to not permit clear-text passwords.<br />
Setting a stricter security policy protects your computer from a malicious hacker trying<br />
to use a rogue LDAP server to gain control of your computer.<br />
The computer must communicate with the LDAP server to show the state of the<br />
security options. Therefore when you change security options for an LDAPv3<br />
connection, the computer’s authentication search policy should include the LDAPv3<br />
connection.<br />
The permissible settings of an LDAPv3 connection’s security options are subject to the<br />
LDAP server’s security capabilities and requirements. For example, if the LDAP server<br />
doesn’t support Kerberos authentication, several LDAPv3 connection security options<br />
are disabled.<br />
To change an LDAPv3 connection’s security options:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Search Policy.<br />
2 Click Authentication and make sure the LDAPv3 directory you want is listed in the<br />
search policy.<br />
For more information about adding the LDAPv3 directory to the authentication search<br />
policy, see “Defining Custom Search Policies” on page 130.<br />
3 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
4 Click Services.<br />
5 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
6 If the list of server configurations is hidden, click Show Options.<br />
7 Select the configuration for the directory you want, then click Edit.<br />
8 Click Security and then change any of the following settings.<br />
Note: The security settings here and on the corresponding LDAP server are determined<br />
when the LDAP connection is set up. The settings aren’t updated automatically if the<br />
server settings are changed.<br />
If any of the last four options are selected but disabled, the LDAP directory requires<br />
them. If any of these options are unselected and disabled, the LDAP server doesn’t<br />
support them. For more information about setting these options for a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
LDAP directory, see “Setting a Security Policy for an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>” on<br />
page 184.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 145
 Use authentication when connecting: Determines whether the LDAPv3 connection<br />
authenticates itself with the LDAP directory by supplying the specified distinguished<br />
name and password. This option is not visible if the LDAPv3 connection uses trusted<br />
binding with the LDAP directory.<br />
 Bound to the directory as: Specifies the credentials the LDAPv3 connection uses for<br />
trusted binding with the LDAP directory. This option and the credentials can’t be<br />
changed here. Instead, you can unbind and then bind again with different<br />
credentials.<br />
For more information, see “Stopping Trusted Binding with an LDAP <strong>Directory</strong>” on<br />
page 150 and “Setting Up Trusted Binding for an LDAP <strong>Directory</strong>” on page 149.<br />
This option is not visible unless the LDAPv3 connection uses trusted binding.<br />
 Disable clear text passwords: Determines whether the password is to be sent as<br />
clear-text if it can’t be validated using an authentication method that sends an<br />
encrypted password.<br />
For more information, see “Selecting Authentication Methods for Shadow Password<br />
Users” on page 113 and “Selecting Authentication Methods for <strong>Open</strong> <strong>Directory</strong><br />
Passwords” on page 114.<br />
 Digitally sign all packets (requires Kerberos): Certifies that directory data from the<br />
LDAP server hasn’t been intercepted and modified by another computer while en<br />
route to your computer.<br />
 Encrypt all packets (requires SSL or Kerberos): Requires the LDAP server to encrypt<br />
directory data using SSL or Kerberos before sending it to your computer. Before you<br />
select the “Encrypt all packets (requires SSL or Kerberos)” checkbox, ask your <strong>Open</strong><br />
<strong>Directory</strong> administrator if SSL is needed.<br />
 Block man-in-the-middle attacks (requires Kerberos) Protects against a rogue<br />
server posing as the LDAP server. Best if used with the “Digitally sign all packets”<br />
option.<br />
Configuring LDAP Searches and Mappings<br />
Using <strong>Directory</strong> Utility, you can edit the mappings, search bases, and search scopes that<br />
specify how <strong>Mac</strong> <strong>OS</strong> X finds specific data items in an LDAP directory. You can edit these<br />
settings separately for each LDAP directory configuration listed in <strong>Directory</strong> Utility. Each<br />
LDAP directory configuration specifies how <strong>Mac</strong> <strong>OS</strong> X accesses data in an LDAPv3 or<br />
LDAPv2 directory.<br />
You can edit the following:<br />
 The mapping of each <strong>Mac</strong> <strong>OS</strong> X record type to one or more LDAP object classes<br />
 The mapping of <strong>Mac</strong> <strong>OS</strong> X data types, or attributes, to LDAP attributes for each<br />
record type<br />
 The LDAP search base and search scope that determine where <strong>Mac</strong> <strong>OS</strong> X looks for a<br />
<strong>Mac</strong> <strong>OS</strong> X record type in an LDAP directory<br />
146 Chapter 8 Advanced <strong>Directory</strong> Client Settings
When mapping <strong>Mac</strong> <strong>OS</strong> X user attributes to a read/write LDAP directory domain (an<br />
LDAP domain that is not read-only), the LDAP attribute mapped to RealName must not<br />
be the same as the first attribute in a list of LDAP attributes mapped to RecordName.<br />
For example, the cn attribute must not be the first attribute mapped to RecordName if<br />
cn is also mapped to RealName.<br />
If the LDAP attribute mapped to RealName is the same as the first attribute mapped to<br />
RecordName, problems will occur when you try to edit the full (long) name or the first<br />
short name in Workgroup Manager.<br />
For more information about <strong>Mac</strong> <strong>OS</strong> X record types and attributes, see the Appendix,<br />
“<strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data.”<br />
To edit the search bases and mappings for an LDAP server:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 Click Services.<br />
4 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
5 If the list of server configurations is hidden, click Show Options.<br />
6 In the list, select a server configuration and click Edit.<br />
7 Click Search & Mappings.<br />
8 Select the mappings you want to use as a starting point; otherwise, choose Custom to<br />
begin with no predefined mappings.<br />
If you choose one of the LDAP mapping templates a search base suffix that you can<br />
change appears, or you can accept the default search base suffix by clicking OK.<br />
Click the “Access this LDAPv3 server using” pop-up menu and choose a mapping<br />
template to use its mappings as a starting point.<br />
9 Add record types and change their search bases as needed:<br />
 To add record types, click Add (below the Record Types and Attributes list); then, in<br />
the sheet that appears, select Record Types, select one or more record types from the<br />
list, and click OK.<br />
 To change the search base and search scope of a record type, select it in the Record<br />
Types and Attributes list; then, edit the “Search base” field. Select “all subtrees” to set<br />
the search scope to include the LDAP directory’s hierarchy from the search base<br />
down, or select “first level only” to set the search scope to include only the search<br />
base and one level below it in the LDAP directory’s hierarchy.<br />
 To remove a record type, in the Record Types and Attributes list select the type and<br />
click Delete.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 147
 To add a mapping for a record type, select the record type in the Record Types and<br />
Attributes list, then click Add (below “Map to __ items in list”) and enter the name of<br />
an object class from the LDAP directory. To add another LDAP object class, press<br />
Return and enter the name of the object class and specify whether to use all or any<br />
of the listed LDAP object classes by using the pop-up menu above the list.<br />
 To change a mapping for a record type, select the record type in the Record Types<br />
and Attributes list, then double-click the LDAP object class you want to change in<br />
the “Map to __ items in list” and edit it. Specify whether to use all or any of the listed<br />
LDAP object classes by using the pop-up menu above the list.<br />
 To remove a mapping for a record type, in the Record Types and Attributes list, select<br />
the record type, select the LDAP object class you want to remove from the “Map to<br />
__ items in list,” and then click Delete (below “Map to __ items in list”).<br />
10 Add attributes and change their mappings as needed:<br />
 To add attributes to a record type, in the Record Types and Attributes list, select the<br />
record type and click Add (below the Record Types and Attributes list); then, in the<br />
sheet that appears, select Attribute Types, select one or more attribute types, and<br />
click OK.<br />
 To add a mapping for an attribute, in the Record Types and Attributes list, select the<br />
attribute, click Add (below “Map to __ items in list”), and enter the name of an<br />
attribute from the LDAP directory; to add another LDAP attribute, press Return and<br />
enter the name of the attribute.<br />
 To change a mapping for an attribute, in the Record Types and Attributes list, select<br />
the attribute, double-click the item you want to change in the “Map to __ items in<br />
list,” and then edit the item name.<br />
 To remove a mapping for an attribute, in the Record Types and Attributes list, select<br />
the attribute, select the item you want to remove from the “Map to __ items in list,”<br />
and then click Delete (below “Map to __ items in list”).<br />
 To change the order of attributes appearing in the list on the right, drag the<br />
attributes up or down in the list.<br />
11 To save your mappings as a template, click Save Template.<br />
Templates saved in the default location are listed in pop-up menus of LDAP mapping<br />
templates the next time you open <strong>Directory</strong> Utility. The default location for saved<br />
templates is in your home folder at this path:<br />
~/Library/Application Support/<strong>Directory</strong> Utility/LDAPv3/Templates<br />
12 To store the mappings in the LDAP directory so it can supply them automatically to its<br />
clients, click Write to <strong>Server</strong> and then enter a search base to store the mappings, a<br />
distinguished name of an administrator or other user with write permission for the<br />
search base (for example, uid=diradmin,cn=users,dc=ods,dc=example,dc=com), and a<br />
password.<br />
148 Chapter 8 Advanced <strong>Directory</strong> Client Settings
If you are writing mappings to an <strong>Open</strong> <strong>Directory</strong> LDAP server, the correct search base<br />
is “cn=config, suffix” (where suffix is the server’s search base suffix, such as<br />
“dc=ods,dc=example,dc=com”).<br />
The LDAP directory supplies its mappings to <strong>Mac</strong> <strong>OS</strong> X clients whose custom search<br />
policy includes a connection that’s configured to get mappings from the LDAP server.<br />
The LDAP directory also supplies its mappings to all <strong>Mac</strong> <strong>OS</strong> X clients that have an<br />
automatic search policy. For more information, see “Configuring Access to an LDAP<br />
<strong>Directory</strong>” on page 136 and “Using Advanced Search Policy Settings” on page 128.<br />
Setting Up Trusted Binding for an LDAP <strong>Directory</strong><br />
You can use <strong>Directory</strong> Utility to set up trusted binding between the computer and an<br />
LDAP directory that supports trusted binding. The binding is mutually authenticated by<br />
an authenticated computer record that’s created in the directory when you set up<br />
trusted binding.<br />
The computer can’t be configured to use trusted LDAP binding and a DHCP-supplied<br />
LDAP directory. Trusted LDAP binding is inherently static, but DHCP-supplied LDAP is<br />
dynamic.<br />
For more information, see “Enabling or Disabling Use of a DHCP-Supplied LDAP<br />
<strong>Directory</strong>” on page 134 and “Setting a Binding Policy for an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>” on<br />
page 184.<br />
To set up trusted binding to an LDAP directory:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 Select the server configuration you want and click Edit.<br />
6 Click Bind, then enter the following credentials and click OK.<br />
Enter the name of the computer and the name and password of an LDAP directory<br />
domain administrator. The computer name can’t be in use by another computer for<br />
trusted binding or other network services.<br />
If the Bind button doesn’t appear, the LDAP directory doesn’t support trusted binding.<br />
7 Verify that you supplied the correct computer name.<br />
If you see an alert saying that a computer record exists, click Cancel to go back and<br />
change the computer name, or click Overwrite to replace the existing computer record.<br />
The existing computer record might be abandoned, or it might belong to another<br />
computer. If you replace an existing computer record, notify the LDAP directory<br />
administrator in case replacing the record disables another computer.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 149
In such a situation, the LDAP directory administrator must give the disabled computer<br />
another name and add it to the computer group it belonged to, using a different name<br />
for that computer.<br />
For more information about adding a computer to a computer group, see the<br />
computer groups chapter of User Management.<br />
8 To finish setting up trusted binding, click OK.<br />
Stopping Trusted Binding with an LDAP <strong>Directory</strong><br />
You can use <strong>Directory</strong> Utility to stop trusted binding between a computer and an LDAP<br />
directory that permits but doesn’t require trusted binding.<br />
To stop trusted binding with an LDAP directory:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, click it and then enter the name and password of an<br />
administrator.<br />
3 In the list of services, select LDAPv3, then click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 Select the server configuration you want, then click Edit.<br />
6 Click Unbind, then enter the following credentials and click OK.<br />
Enter the name and password of an LDAP directory administrator (not a local computer<br />
administrator).<br />
If trusted binding hasn’t been set up on this computer, the Unbind button does not<br />
appear.<br />
If you see an alert saying the computer can’t contact the LDAP server, click OK if you<br />
want to forcibly stop trusted binding.<br />
If you forcibly stop trusted binding, this computer still has a computer record in the<br />
LDAP directory. Notify the LDAP directory administrator so the administrator knows to<br />
remove the computer from the computer group.<br />
For more information about removing a computer from its computer group, see the<br />
computer groups chapter of User Management.<br />
7 To finish stopping trusted binding, click OK.<br />
Changing the <strong>Open</strong>/Close Timeout for an LDAP Connection<br />
Using <strong>Directory</strong> Utility, you can specify how long <strong>Open</strong> <strong>Directory</strong> waits before<br />
cancelling an attempt to connect to the LDAP server.<br />
To set the open/close timeout for an LDAP connection:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
150 Chapter 8 Advanced <strong>Directory</strong> Client Settings
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 In the list, select a server configuration and click Edit.<br />
6 Click Connection and then enter a value for “<strong>Open</strong>/close times out in __ seconds.”<br />
The default is 15 seconds.<br />
Changing the Query Timeout for an LDAP Connection<br />
Using <strong>Directory</strong> Utility, you can specify how long <strong>Open</strong> <strong>Directory</strong> waits before<br />
cancelling a query sent to the LDAP directory.<br />
To set the query timeout for an LDAP connection:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 In the list, select a server configuration and click Edit.<br />
6 Click Connection and then enter a value for “Query times out in __ seconds.”<br />
The default value is 120 seconds.<br />
Changing the Rebind-Try Delay Time for an LDAP Connection<br />
Using <strong>Directory</strong> Utility, you can specify how long to wait before attempting to<br />
reconnect if an LDAP server fails to respond. You can increase this value to prevent<br />
continuous reconnect attempts.<br />
To set the rebind delay for idle LDAP clients:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 In the list, select a server configuration and click Edit.<br />
6 Click Connection and then enter a value for “Rebind attempted in __ seconds.”<br />
The default is 120 seconds.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 151
Changing the Idle Timeout for an LDAP Connection<br />
Using <strong>Directory</strong> Utility, you can specify how long an LDAP connection remains idle<br />
before <strong>Open</strong> <strong>Directory</strong> closes the connection. You can adjust this setting to reduce the<br />
number of open connections on the LDAP server.<br />
To set a timeout interval for an idle LDAP connection:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 In the list, select a server configuration and click Edit.<br />
6 Click Connection and enter a value for “Connection idles out in __ minutes.”<br />
The default is 1 minute.<br />
Forcing Read-Only LDAPv2 Access<br />
Using <strong>Directory</strong> Utility, you can force a connection to an LDAP server using LDAPv2.<br />
This forced LDAPv2 connection is read-only (not read-write) and doesn’t use SSL.<br />
To force read-only LDAPv2 access to an LDAP server:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 In the list, select the server configuration and click Edit.<br />
6 Click Connection and then select “Use LDAPv2 (read only).”<br />
Ignoring LDAP <strong>Server</strong> Referrals<br />
Using <strong>Directory</strong> Utility, you can specify whether the computer ignores or follows an<br />
LDAP server’s referral to look on other LDAP servers or replicas for information.<br />
<strong>Server</strong> referrals can help a computer find information but can also delay logins or cause<br />
other delays if the computer must verify referrals to other LDAP servers.<br />
To specify whether to ignore LDAP server referrals:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
152 Chapter 8 Advanced <strong>Directory</strong> Client Settings
4 If the list of server configurations is hidden, click Show Options.<br />
5 In the list, select a server configuration and click Edit.<br />
6 Click Connection and select “Ignore server referrals.”<br />
Authenticating an LDAP Connection<br />
Using <strong>Directory</strong> Utility, you can set up an authenticated connection to an LDAP<br />
directory. This authentication is one-way. The computer proves its identity to an LDAP<br />
directory, but the LDAP directory doesn’t prove its authenticity to the computer. For<br />
mutual authentication, see “Setting Up Trusted Binding for an LDAP <strong>Directory</strong>” on<br />
page 149.<br />
Note: If trusted binding is set up between the computer and the LDAP directory, an<br />
authenticated connection would be redundant and you can’t set one up.<br />
To set up an authenticated LDAPv3 connection:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 In the list, select a server configuration and click Edit.<br />
6 Click Security.<br />
7 Select “Use authentication when connecting,” and then enter a user’s distinguished<br />
name and password.<br />
The distinguished name can specify any user account that has permission to see data<br />
in the directory. For example, a user account whose short name is “authenticator” on an<br />
LDAP server and whose address is ods.example.com has the distinguished name<br />
uid=authenticator,cn=users,dc=ods,dc=example,dc=com.<br />
Important: If the distinguished name or password are incorrect, no one can log in to<br />
the computer using user accounts from the LDAP directory.<br />
Changing the Password Used for Authenticating an LDAP Connection<br />
Using <strong>Directory</strong> Utility, you can update an authenticated LDAP connection to use a<br />
password that has been changed on the LDAP server. (All computers having an<br />
authenticated connection to an LDAP server must be updated if the password used to<br />
authenticate the LDAP connection is changed on the server.)<br />
To change the password for an LDAP connection:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 153
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 In the list, select a server configuration and click Edit.<br />
6 Click Security and change the Password setting:<br />
 If the Password setting is dimmed because “Use authentication when connecting” is<br />
not selected, see “Authenticating an LDAP Connection” on page 153.<br />
 If the Password setting is dimmed because “Bound to the directory as” is selected<br />
(but dimmed), the connection isn’t authenticated with a user password. Instead, the<br />
connection uses an authenticated computer record for trusted binding.<br />
Mapping Config Record Attributes for LDAP Directories<br />
To store information for managed <strong>Mac</strong> <strong>OS</strong> X users in a non-<strong>Apple</strong> LDAP directory, you<br />
must map the following Config record type attributes: RealName and DataStamp.<br />
If you do not map these attributes, the following error message will appear when you<br />
use Workgroup Manager to change a user record that resides in the LDAP directory:<br />
The attribute with name “dsRecTypeStandard:Config” is not mapped.<br />
You can ignore this message if you are not using <strong>Mac</strong> <strong>OS</strong> X client management, which<br />
depends on the Config record type’s RealName and DataStamp attributes for a cache.<br />
Editing RFC 2307 Mapping to Enable Creating Users<br />
Before you can use Workgroup Manager to create users on a non-<strong>Apple</strong> LDAP directory<br />
server that uses RFC 2307 (UNIX) mappings, you must edit the mapping of the Users<br />
record type. You do this with <strong>Directory</strong> Utility.<br />
To enable creating user records in an LDAP directory with RFC 2307 mappings:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 If the list of server configurations is hidden, click Show Options.<br />
5 Select the directory configuration with RFC 2307 mappings, then click Edit.<br />
6 Click Search & Mappings.<br />
7 In the list on the left, select Users.<br />
By default, “Map to __ items in list” is set to Any and the list on the right includes<br />
posixAccount, inetOrgPerson, and shadowAccount.<br />
8 Change “Map to __ items in list” to All and then change the list on the right to include<br />
the set of LDAP object classes you want the Users record type mapped to.<br />
154 Chapter 8 Advanced <strong>Directory</strong> Client Settings
For example, you could delete shadowAccount from the list so that Users map to only<br />
posixAccount and inetOrgPerson. Alternatively, you could map Users to account,<br />
posixAccount, and shadowAccount.<br />
To change an item on the list, double-click it.To add an item to the list, click Add.To<br />
delete the selected item from the list, click Delete. To change the order of listed items,<br />
drag items up or down in the list.You can find the object classes of user records in the<br />
LDAP directory by using the ldapsearch UNIX tool in Terminal. For example, the<br />
following code finds object classes for a user record whose cn attribute is “Leonardo da<br />
Vinci:”<br />
$ ldapsearch -x -h ldapserver.example.com -b "dc=example, dc=com"<br />
'cn=Leonardo da Vinci' objectClass<br />
The output displayed for this example would be:<br />
# Leonardo da Vinci, example.com<br />
dn: cn=Leonardo da Vinci, dc=example, dc=com<br />
objectClass: inetOrgPerson<br />
objectClass: posixAccount<br />
Preparing a Read-Only LDAP <strong>Directory</strong> for <strong>Mac</strong> <strong>OS</strong> X<br />
If you want a <strong>Mac</strong> <strong>OS</strong> X computer to get administrative data from a read-only LDAP<br />
directory, the data must exist in the format required by <strong>Mac</strong> <strong>OS</strong> X. You might need to<br />
add, change, or reorganize data in the read-only LDAP directory.<br />
Because <strong>Mac</strong> <strong>OS</strong> X cannot write data to a read-only directory, you must use other tools<br />
to make the changes. The tools must reside on the server that hosts the read-only<br />
LDAP directory.<br />
To prepare a read-only LDAP directory for <strong>Mac</strong> <strong>OS</strong> X:<br />
1 Go to the server that hosts the read-only LDAP directory and configure it to support<br />
LDAP-based authentication and password checking.<br />
2 Change the LDAP directory’s object classes and attributes as necessary to provide the<br />
data needed by <strong>Mac</strong> <strong>OS</strong> X.<br />
For specifications of the data required by <strong>Mac</strong> <strong>OS</strong> X directory services, see the<br />
Appendix, “<strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data.”<br />
Populating LDAP Directories with Data for <strong>Mac</strong> <strong>OS</strong> X<br />
After configuring access to LDAP directory domains and setting up data mapping, you<br />
can populate them with records and data for <strong>Mac</strong> <strong>OS</strong> X. For LDAP directories that<br />
permit remote administration (read/write access), you can use the Workgroup Manager<br />
application, which is included with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>, as follows:<br />
 Identify share points and shared domains that you want to mount automatically in<br />
users’ Network browsers (what users see when they click Network in a Finder<br />
window sidebar).<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 155
Use the Sharing in <strong>Server</strong> Admin and the Network modules of Workgroup Manager.<br />
For more information, see File Services <strong>Administration</strong>.<br />
 Define user and group records and configure their settings.<br />
Use the Accounts module of Workgroup Manager. For more information, see User<br />
Management.<br />
 Define lists of computers that have the same preference settings and are available to<br />
the same users and groups.<br />
Use the Computers module of Workgroup Manager. For more information, see User<br />
Management.<br />
In all cases, click the small globe icon above the list of users and choose from the popup<br />
menu in Workgroup Manager to open the LDAP directory domain. If the LDAP<br />
directory is not listed in the pop-up menu, choose Other from this menu to select the<br />
LDAP directory.<br />
Note: To add records and data to a read-only LDAP directory, you must use tools on the<br />
server that host the LDAP directory.<br />
Using Advanced Active <strong>Directory</strong> Service Settings<br />
You can configure a server with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> or a computer with <strong>Mac</strong> <strong>OS</strong> X to<br />
access an Active <strong>Directory</strong> domain on a Windows 2000 or Windows 2003 server.<br />
For task descriptions and instructions, see:<br />
 “About Active <strong>Directory</strong> Access” on page 157<br />
 “Configuring Access to an Active <strong>Directory</strong> Domain” on page 159<br />
 “Setting Up Mobile User Accounts in Active <strong>Directory</strong>” on page 161<br />
 “Setting Up Home Folders for Active <strong>Directory</strong> User Accounts” on page 162<br />
 “Setting a UNIX Shell for Active <strong>Directory</strong> User Accounts” on page 163<br />
 “Mapping the UID to an Active <strong>Directory</strong> Attribute” on page 163<br />
 “Mapping the Primary Group ID to an Active <strong>Directory</strong> Attribute” on page 164<br />
 “Mapping the Group ID in Group Accounts to an Active <strong>Directory</strong> Attribute” on<br />
page 165<br />
 “Specifying a Preferred Active <strong>Directory</strong> <strong>Server</strong>” on page 166<br />
 “Changing the Active <strong>Directory</strong> Groups That Can Administer the Computer” on<br />
page 166<br />
 “Controlling Authentication from All Domains in the Active <strong>Directory</strong> Forest” on<br />
page 167<br />
 “Unbinding from the Active <strong>Directory</strong> <strong>Server</strong>” on page 168<br />
 “Editing User Accounts and Other Records in Active <strong>Directory</strong>” on page 168<br />
156 Chapter 8 Advanced <strong>Directory</strong> Client Settings
Alternative methods for accessing an Active <strong>Directory</strong> domain are appropriate for some<br />
networks. See “Setting Up LDAP Access to Active <strong>Directory</strong> Domains” on page 169.<br />
About Active <strong>Directory</strong> Access<br />
You can configure <strong>Mac</strong> <strong>OS</strong> X to access basic user account information in an Active<br />
<strong>Directory</strong> domain of a Windows 2000 or later server. This is possible because of an<br />
Active <strong>Directory</strong> plug-in for <strong>Directory</strong> Utility. This Active <strong>Directory</strong> plug-in is listed in the<br />
Services pane of <strong>Directory</strong> Utility.<br />
You do not need to make schema changes to the Active <strong>Directory</strong> domain to get basic<br />
user account information. You might change the default Access Control List (ACL) of<br />
specific attributes so computer accounts can read user properties.<br />
The Active <strong>Directory</strong> plug-in generates all attributes required for <strong>Mac</strong> <strong>OS</strong> X<br />
authentication from standard attributes in Active <strong>Directory</strong> user accounts. The plug-in<br />
also supports Active <strong>Directory</strong> authentication policies, including password changes,<br />
expirations, forced changes, and security options.<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>v10.5</strong> supports packet encryption and packet signing options for all Windows<br />
Active <strong>Directory</strong> domains. This functionality is on by default as “allow.” You can change<br />
the default setting to disabled or required by using the dsconfigad command-line<br />
tool. The packet encryption and packet signing options ensures all data to and from<br />
the Active <strong>Directory</strong> Domain for record lookups is protected.<br />
The Active <strong>Directory</strong> plug-in dynamically generates a unique user ID and a primary<br />
group ID based on the user account’s Globally Unique ID (GUID) in the Active <strong>Directory</strong><br />
domain. The generated user ID and primary group ID are the same for each user<br />
account, even if the account is used to log in to different <strong>Mac</strong> <strong>OS</strong> X computers.<br />
Alternatively, you can force the Active <strong>Directory</strong> plug-in to map the user ID to Active<br />
<strong>Directory</strong> attributes that you specify.<br />
The Active <strong>Directory</strong> plug-in generates a group ID based on the Active <strong>Directory</strong> group<br />
account’s GUID. You can also force the plug-in to map the group ID for group accounts<br />
to Active <strong>Directory</strong> attributes that you specify.<br />
When someone logs in to <strong>Mac</strong> <strong>OS</strong> X with an Active <strong>Directory</strong> user account, the Active<br />
<strong>Directory</strong> plug-in can mount the Windows network home folder specified in the Active<br />
<strong>Directory</strong> user account as the user’s <strong>Mac</strong> <strong>OS</strong> X home folder. You can specify whether to<br />
use the network home specified by Active <strong>Directory</strong>’s standard home <strong>Directory</strong><br />
attribute or by <strong>Mac</strong> <strong>OS</strong> X’s home <strong>Directory</strong> attribute (if the Active <strong>Directory</strong> schema has<br />
been extended to include it).<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 157
Alternatively, you can configure the plug-in to create a local home folder on the startup<br />
volume of the <strong>Mac</strong> <strong>OS</strong> X client computer. In this case, the plug-in also mounts the<br />
user’s Windows network home folder (specified in the Active <strong>Directory</strong> user account) as<br />
a network volume, like a share point. Using the Finder, the user can then copy files<br />
between the Windows home folder network volume and the local <strong>Mac</strong> <strong>OS</strong> X home<br />
folder.<br />
The Active <strong>Directory</strong> plug-in can also create mobile accounts for users. A mobile<br />
account has a local home folder on the startup volume of the <strong>Mac</strong> <strong>OS</strong> X client<br />
computer. (The user also has a network home folder as specified in the user’s Active<br />
<strong>Directory</strong> account).<br />
A mobile account caches the user’s Active <strong>Directory</strong> authentication credentials on the<br />
<strong>Mac</strong> <strong>OS</strong> X client computer. The cached credentials permit the user to log in using the<br />
Active <strong>Directory</strong> name and password when the client computer is disconnected from<br />
the Active <strong>Directory</strong> server.<br />
A mobile account has a local home folder on the startup volume of the <strong>Mac</strong> <strong>OS</strong> X client<br />
computer. (The user also has a network home folder as specified in the user’s Active<br />
<strong>Directory</strong> account.)<br />
If the Active <strong>Directory</strong> schema has been extended to include <strong>Mac</strong> <strong>OS</strong> X record types<br />
(object classes) and attributes, the Active <strong>Directory</strong> plug-in detects and accesses them.<br />
For example, the Active <strong>Directory</strong> schema could be changed using Windows<br />
administration tools to include <strong>Mac</strong> <strong>OS</strong> X managed client attributes. This schema<br />
change enables the Active <strong>Directory</strong> plug-in to support managed client settings made<br />
using <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>’s Workgroup Manager application.<br />
<strong>Mac</strong> <strong>OS</strong> X clients assume full read access to attributes that are added to the directory.<br />
Therefore, it might be necessary to change the ACL of those attributes to permit<br />
computer groups to read these added attributes.<br />
The Active <strong>Directory</strong> plug-in discovers all domains in an Active <strong>Directory</strong> forest. You can<br />
configure the plug-in to permit users from any domain in the forest to authenticate on<br />
a <strong>Mac</strong> <strong>OS</strong> X computer. Alternatively, you can permit only specific domains to be<br />
authenticated on the client.<br />
The Active <strong>Directory</strong> plug-in fully supports Active <strong>Directory</strong> replication and failover. It<br />
discovers multiple domain controllers and determines the closest one. If a domain<br />
controller becomes unavailable, the plug-in falls back to another nearby domain<br />
controller.<br />
158 Chapter 8 Advanced <strong>Directory</strong> Client Settings
The Active <strong>Directory</strong> plug-in uses LDAP to access Active <strong>Directory</strong> user accounts and<br />
Kerberos to authenticate them. The Active <strong>Directory</strong> plug-in does not use Microsoft’s<br />
proprietary Active <strong>Directory</strong> Services Interface (ADSI) to get directory or authentication<br />
services.<br />
Configuring Access to an Active <strong>Directory</strong> Domain<br />
Using the Active <strong>Directory</strong> plug-in listed in <strong>Directory</strong> Utility, you can configure<br />
<strong>Mac</strong> <strong>OS</strong> X to access basic user account information in an Active <strong>Directory</strong> domain on a<br />
Windows server.<br />
The Active <strong>Directory</strong> plug-in generates all attributes required for <strong>Mac</strong> <strong>OS</strong> X<br />
authentication. No changes to the Active <strong>Directory</strong> schema are required.<br />
The Active <strong>Directory</strong> plug-in detects and accesses standard <strong>Mac</strong> <strong>OS</strong> X record types and<br />
attributes (such as the attributes required for <strong>Mac</strong> <strong>OS</strong> X client management), if the<br />
Active <strong>Directory</strong> schema has been extended to include them.<br />
WARNING: Advanced options of the Active <strong>Directory</strong> plug-in can map you to the<br />
<strong>Mac</strong> <strong>OS</strong> X unique user ID (UID), primary group ID (GID), and group GID attribute to the<br />
correct attributes that have been added to the Active <strong>Directory</strong> schema. If you change<br />
the setting of these mapping options later, users might lose access to previously<br />
created files.<br />
Important: If your computer name contains a hyphen you may not be able to join or<br />
bind to a <strong>Directory</strong> Domain such as LDAP or Active <strong>Directory</strong>. To establish binding, use<br />
a computer name that does not contain a hyphen.<br />
To configure access to an Active <strong>Directory</strong> domain:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select Active <strong>Directory</strong> and click the Edit (/) button.<br />
4 Enter the DNS name of the Active <strong>Directory</strong> domain you want to bind to the computer<br />
you’re configuring.<br />
The administrator of the Active <strong>Directory</strong> domain can tell you the DNS name to enter.<br />
5 If necessary, edit the Computer ID.<br />
The Computer ID is the name by which the computer is known in the Active <strong>Directory</strong><br />
domain, and it’s preset to the name of the computer. You might change this to conform<br />
to your organization’s established scheme for naming computers in the Active<br />
<strong>Directory</strong> domain. If you’re not sure, ask the Active <strong>Directory</strong> domain administrator.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 159
6 (Optional) Set advanced options.<br />
If the advanced options are hidden, click Show Advanced Options and set options in<br />
the User Experience, Mappings, and Administrative panes. You can also change<br />
advanced option settings later.<br />
For more information about advanced options, see:<br />
 “Setting Up Mobile User Accounts in Active <strong>Directory</strong>” on page 161<br />
 “Setting Up Home Folders for Active <strong>Directory</strong> User Accounts” on page 162<br />
 “Setting a UNIX Shell for Active <strong>Directory</strong> User Accounts” on page 163<br />
 “Mapping the UID to an Active <strong>Directory</strong> Attribute” on page 163<br />
 “Mapping the Primary Group ID to an Active <strong>Directory</strong> Attribute” on page 164<br />
 “Mapping the Group ID in Group Accounts to an Active <strong>Directory</strong> Attribute” on<br />
page 165<br />
 “Specifying a Preferred Active <strong>Directory</strong> <strong>Server</strong>” on page 166<br />
 “Changing the Active <strong>Directory</strong> Groups That Can Administer the Computer” on<br />
page 166<br />
 “Controlling Authentication from All Domains in the Active <strong>Directory</strong> Forest” on<br />
page 167<br />
7 Click Bind, use the following to authenticate as a user who has rights to bind a<br />
computer to the Active <strong>Directory</strong> domain, select the search policies you want Active<br />
<strong>Directory</strong> added to (see below), and click OK:<br />
 Username and Password: You may be able to authenticate by entering the name<br />
and password of your Active <strong>Directory</strong> user account, or the Active <strong>Directory</strong> domain<br />
administrator might need to provide a name and password.<br />
 Computer OU: Enter the organizational unit (OU) for the computer you’re<br />
configuring.<br />
 Use for authentication: Use to determine whether Active <strong>Directory</strong> is added to the<br />
computer’s authentication search policy.<br />
 Use for contacts: Use to determine whether Active <strong>Directory</strong> is added to the<br />
computer’s contacts search policy.<br />
When you click OK, <strong>Directory</strong> Utility sets up trusted binding between the computer<br />
you’re configuring and the Active <strong>Directory</strong> server. The computer’s search policies are<br />
set according to the options you selected when you authenticated, and Active<br />
<strong>Directory</strong> is enabled in <strong>Directory</strong> Utility’s Services pane.<br />
With the default settings for Active <strong>Directory</strong> advanced options, the Active <strong>Directory</strong><br />
forest is added to the computer’s authentication search policy and contacts search<br />
policy if you selected “Use for authentication” or “Use for contacts.”<br />
However, if you deselect “Allow authentication from any domain in the forest” in the<br />
Administrative advanced options pane before clicking Bind, the nearest Active<br />
<strong>Directory</strong> domain is added instead of the forest.<br />
160 Chapter 8 Advanced <strong>Directory</strong> Client Settings
You can change search policies later by adding or removing the Active <strong>Directory</strong> forest<br />
or individual domains. For more information, see “Defining Custom Search Policies” on<br />
page 130.<br />
8 (Optional) Join the server to the Active <strong>Directory</strong> Kerberos realm.<br />
On the server or an administrator computer that can connect to the server, open <strong>Server</strong><br />
Admin and select <strong>Open</strong> <strong>Directory</strong> for the server. Click Settings, then click General. Click<br />
Join Kerberos, then choose the Active <strong>Directory</strong> Kerberos realm from the pop-up menu<br />
and enter credentials for a local administrator on this server.<br />
For more information, see “Joining a <strong>Server</strong> to a Kerberos Realm” on page 102.<br />
Setting Up Mobile User Accounts in Active <strong>Directory</strong><br />
You can enable or disable mobile Active <strong>Directory</strong> user accounts on a computer that is<br />
configured to use <strong>Directory</strong> Utility’s Active <strong>Directory</strong> plug-in. Users with mobile<br />
accounts can log in using their Active <strong>Directory</strong> credentials when the computer is not<br />
connected to the Active <strong>Directory</strong> server.<br />
The Active <strong>Directory</strong> plug-in caches credentials for a user’s mobile account when the<br />
user logs in while the computer is connected to the Active <strong>Directory</strong> domain. This<br />
credential caching does not require changing the Active <strong>Directory</strong> schema.<br />
If the Active <strong>Directory</strong> schema has been extended to include <strong>Mac</strong> <strong>OS</strong> X managed client<br />
attributes, those mobile account settings are used instead of the Active <strong>Directory</strong> plugin’s<br />
mobile account setting.<br />
You can have mobile accounts created automatically or you can require that Active<br />
<strong>Directory</strong> users confirm creation of a mobile account.<br />
To enable or disable mobile accounts in an Active <strong>Directory</strong> domain:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select Active <strong>Directory</strong> and click the Edit (/) button.<br />
4 If the advanced options are hidden, click Show Advanced Options.<br />
5 Click User Experience, then click “Create mobile account at login,” and optionally click<br />
“Require confirmation before creating a mobile account.”<br />
6 If both options are selected, each user decides whether to create a mobile account<br />
during login. When a user logs in to <strong>Mac</strong> <strong>OS</strong> X using an Active <strong>Directory</strong> user account,<br />
or when logging in as a network user, the user sees a dialog with controls for creating a<br />
mobile account immediately. If the first option is selected and the second option is<br />
unselected, mobile accounts are created when users log in. If the first option is not<br />
selected, the second option is disabled. Click OK.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 161
Setting Up Home Folders for Active <strong>Directory</strong> User Accounts<br />
On a computer that’s configured to use the <strong>Directory</strong> Utility Active <strong>Directory</strong> plug-in,<br />
you can enable or disable network home folders or local home folders for Active<br />
<strong>Directory</strong> user accounts.<br />
With network home folders, a user’s Windows network home folder is mounted as the<br />
<strong>Mac</strong> <strong>OS</strong> X home folder when the user logs in.<br />
You determine whether the network home folder location is obtained from the Active<br />
<strong>Directory</strong> standard home<strong>Directory</strong> attribute or from the <strong>Mac</strong> <strong>OS</strong> X home<strong>Directory</strong><br />
attribute, if the Active <strong>Directory</strong> schema has been extended to include it.<br />
With local home folders, each Active <strong>Directory</strong> user who logs in has a home folder on<br />
the <strong>Mac</strong> <strong>OS</strong> X startup disk. In addition, the user’s network home folder is mounted as a<br />
network volume, like a share point. The user can copy files between this network<br />
volume and the local home folder.<br />
To set up home folders for Active <strong>Directory</strong> user accounts:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select Active <strong>Directory</strong> and click the Edit (/) button.<br />
4 If the advanced options are hidden, click Show Advanced Options.<br />
5 Click User Experience.<br />
6 If you want Active <strong>Directory</strong> user accounts to have local home folders in the computer’s<br />
/Users folder, click “Force local home folder on startup disk.”<br />
This option is not available if “Create mobile account at login” is selected.<br />
7 To use the Active <strong>Directory</strong> standard attribute for the home folder location, select “Use<br />
UNC path from Active <strong>Directory</strong> to derive network home location” and then choose<br />
from the following protocols for accessing the home folder:<br />
 To use the standard Windows protocol SMB, choose smb from the “Network protocol<br />
to be used” pop-up menu.<br />
 To use the standard <strong>Mac</strong>intosh protocol AFP, choose afp from the “Network protocol<br />
to be used” pop-up menu.<br />
8 To use the <strong>Mac</strong> <strong>OS</strong> X attribute for the home folder location, deselect “Use UNC path<br />
from Active <strong>Directory</strong> to derive network home location.”<br />
To use the <strong>Mac</strong> <strong>OS</strong> X attribute, the Active <strong>Directory</strong> schema must be extended to<br />
include it.<br />
9 Click OK.<br />
162 Chapter 8 Advanced <strong>Directory</strong> Client Settings
If you change the name of a user account in the Active <strong>Directory</strong> domain, the server<br />
creates a home folder (and subfolders) for the user account the next time it is used for<br />
logging in to a <strong>Mac</strong> <strong>OS</strong> X computer. The user can still navigate to the old home folder<br />
and see its contents in the Finder.<br />
You can prevent creation of a new home folder by renaming the old folder before the<br />
user next logs in.<br />
Setting a UNIX Shell for Active <strong>Directory</strong> User Accounts<br />
On a computer that’s configured to use <strong>Directory</strong> Utility’s Active <strong>Directory</strong> plug-in, you<br />
can set the command-line shell that users with Active <strong>Directory</strong> accounts will use by<br />
default when interacting with <strong>Mac</strong> <strong>OS</strong> X in the Terminal application.<br />
The default shell is also used for remote interaction through secure shell (SSH) or<br />
Telnet. Each user can override the default shell by changing a Terminal preference.<br />
To set a UNIX shell for Active <strong>Directory</strong> user accounts:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select Active <strong>Directory</strong> and click the Edit (/) button.<br />
4 If the advanced options are hidden, click Show Advanced Options.<br />
5 Click User Experience.<br />
6 Select Default user shell, then enter the default user shell’s path.<br />
7 Click OK.<br />
Mapping the UID to an Active <strong>Directory</strong> Attribute<br />
On a computer that’s configured to use <strong>Directory</strong> Utility’s Active <strong>Directory</strong> plug-in, you<br />
can specify an Active <strong>Directory</strong> attribute that you want mapped to <strong>Mac</strong> <strong>OS</strong> X’s unique<br />
user ID (UID) attribute.<br />
Usually, the Active <strong>Directory</strong> schema must be extended to include an attribute that’s<br />
suitable for mapping to the UID:<br />
 If the Active <strong>Directory</strong> administrator extends the Active <strong>Directory</strong> schema by<br />
installing Microsoft’s Services for UNIX, you can map the UID to the msSFU-30-Uid-<br />
Number attribute.<br />
 If the Active <strong>Directory</strong> administrator manually extends the Active <strong>Directory</strong> schema<br />
to include RFC 2307 attributes, you can map the UID to uidNumber.<br />
 If the Active <strong>Directory</strong> administrator manually extends the Active <strong>Directory</strong> schema<br />
to include the <strong>Mac</strong> <strong>OS</strong> X UniqueID attribute, you can map the UID to it.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 163
If UID mapping is disabled, the Active <strong>Directory</strong> plug-in generates a UID based on<br />
Active <strong>Directory</strong>’s standard GUID attribute.<br />
WARNING: If you change the mapping of the UID later, users might lose access to<br />
previously created files.<br />
To map the UID to an attribute in an extended Active <strong>Directory</strong> schema:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select Active <strong>Directory</strong> and click the Edit (/) button.<br />
4 If the advanced options are hidden, click Show Advanced Options.<br />
5 Click Mappings.<br />
6 Select “Map UID to attribute” and enter the name of the Active <strong>Directory</strong> attribute you<br />
want mapped to the UID.<br />
7 Click OK.<br />
Mapping the Primary Group ID to an Active <strong>Directory</strong> Attribute<br />
On a computer that’s configured to use <strong>Directory</strong> Utility’s Active <strong>Directory</strong> plug-in, you<br />
can specify an Active <strong>Directory</strong> attribute that you want mapped to <strong>Mac</strong> <strong>OS</strong> X’s primary<br />
group ID (GID) attribute in user accounts.<br />
Usually, the Active <strong>Directory</strong> schema must be extended to include an attribute that’s<br />
suitable for mapping to the primary GID:<br />
 If the Active <strong>Directory</strong> administrator extends the Active <strong>Directory</strong> schema by<br />
installing Microsoft’s Services for UNIX, you can map the primary GID to the msSFU-<br />
30-Gid-Number attribute.<br />
 If the Active <strong>Directory</strong> administrator manually extends the Active <strong>Directory</strong> schema<br />
to include RFC 2307 attributes, you can map the primary GID to gidNumber.<br />
 If the Active <strong>Directory</strong> administrator manually extends the Active <strong>Directory</strong> schema<br />
to include the <strong>Mac</strong> <strong>OS</strong> X PrimaryGroupID attribute, you can map the primary GID to<br />
it.<br />
If mapping of the primary GID is disabled, the Active <strong>Directory</strong> plug-in generates a<br />
primary GID based on Active <strong>Directory</strong>’s standard GUID attribute.<br />
WARNING: If you change the mapping of the primary GID later, users might lose<br />
access to previously created files.<br />
164 Chapter 8 Advanced <strong>Directory</strong> Client Settings
To map the primary GID to an attribute in an extended Active <strong>Directory</strong> schema:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select Active <strong>Directory</strong> and click the Edit (/) button.<br />
4 If the advanced options are hidden, click Show Advanced Options.<br />
5 Click Mappings.<br />
6 Select “Map user GID to attribute” and enter the name of the Active <strong>Directory</strong> attribute<br />
you want mapped to the primary group ID in user accounts.<br />
7 Click OK.<br />
Mapping the Group ID in Group Accounts to an Active <strong>Directory</strong><br />
Attribute<br />
On a computer that’s configured to use <strong>Directory</strong> Utility’s Active <strong>Directory</strong> plug-in, you<br />
can specify an Active <strong>Directory</strong> attribute that you want mapped to <strong>Mac</strong> <strong>OS</strong> X’s group ID<br />
(GID) attribute in group accounts.<br />
Usually, the Active <strong>Directory</strong> schema must be extended to include an attribute that’s<br />
suitable for mapping to the GID:<br />
 If the Active <strong>Directory</strong> administrator extends the Active <strong>Directory</strong> schema by<br />
installing Microsoft’s Services for UNIX, you can map the GID to the msSFU-30-Gid-<br />
Number attribute.<br />
 If the Active <strong>Directory</strong> administrator manually extends the Active <strong>Directory</strong> schema<br />
to include RFC 2307 attributes, you can map the GID to gidNumber.<br />
 If the Active <strong>Directory</strong> administrator manually extends the Active <strong>Directory</strong> schema<br />
to include the <strong>Mac</strong> <strong>OS</strong> X gidNumber attribute, you can map the GID to it.<br />
If mapping of the GID is disabled, the Active <strong>Directory</strong> plug-in generates a GID based<br />
on Active <strong>Directory</strong>’s standard GUID attribute.<br />
WARNING: If you change the mapping of the GID later, users might lose access to<br />
previously created files.<br />
To map the GID to an attribute in an extended Active <strong>Directory</strong> schema:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select Active <strong>Directory</strong> and click the Edit (/) button.<br />
4 If the advanced options are hidden, click Show Advanced Options.<br />
5 Click Mappings.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 165
6 Select “Map group GID to attribute” and enter the name of the Active <strong>Directory</strong><br />
attribute you want mapped to the GID in group accounts.<br />
7 Click Ok.<br />
Specifying a Preferred Active <strong>Directory</strong> <strong>Server</strong><br />
On a computer that’s configured to use <strong>Directory</strong> Utility’s Active <strong>Directory</strong> plug-in, you<br />
can specify the DNS name of the server whose Active <strong>Directory</strong> domain you want the<br />
computer to access by default.<br />
If the server becomes unavailable in the future, the Active <strong>Directory</strong> plug-in reverts to<br />
another nearby server in the forest.<br />
If this option is deselected, the Active <strong>Directory</strong> plug-in determines the closest Active<br />
<strong>Directory</strong> domain in the forest.<br />
To specify a preferred server for the Active <strong>Directory</strong> plug-in to access:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select Active <strong>Directory</strong> and click the Edit (/) button.<br />
4 If the advanced options are hidden, click Show Advanced Options.<br />
5 Click Administrative.<br />
6 Select “Prefer this domain server” and enter the DNS name of the Active <strong>Directory</strong><br />
server.<br />
7 Click OK.<br />
Changing the Active <strong>Directory</strong> Groups That Can Administer the<br />
Computer<br />
On a computer that’s configured to use <strong>Directory</strong> Utility’s Active <strong>Directory</strong> plug-in, you<br />
can identify Active <strong>Directory</strong> group accounts whose members you want to have<br />
administrator privileges for the computer.<br />
Users that are members of these Active <strong>Directory</strong> group accounts can perform<br />
administrative tasks such as installing software on the <strong>Mac</strong> <strong>OS</strong> X computer that you are<br />
configuring.<br />
To add or remove Active <strong>Directory</strong> group accounts whose members have<br />
administrator privileges:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select Active <strong>Directory</strong> and click the Edit (/) button.<br />
166 Chapter 8 Advanced <strong>Directory</strong> Client Settings
4 If the advanced options are hidden, click Show Advanced Options.<br />
5 Click Administrative<br />
6 Select “Allow administration by” and change the list of Active <strong>Directory</strong> group accounts<br />
whose members you want to have administrator privileges:<br />
 Add a group by clicking the Add (+) button and entering the Active <strong>Directory</strong><br />
domain name, a backslash, and the group account name (for example, ADS\Domain<br />
Admins, IL2\Domain Admins).<br />
 Delete a group by selecting it in the list and then clicking the Delete (–) button.<br />
7 Click OK.<br />
Controlling Authentication from All Domains in the Active <strong>Directory</strong><br />
Forest<br />
On a computer that’s configured to use <strong>Directory</strong> Utility’s Active <strong>Directory</strong> plug-in, you<br />
can permit users in the Active <strong>Directory</strong> forest to authenticate from all domains, or you<br />
can restrict authentication to users from individual domains.<br />
To control whether users can authenticate from all domains in the forest:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select Active <strong>Directory</strong> and click the Edit (/) button.<br />
4 If the advanced options are hidden, click Show Advanced Options.<br />
5 Click Administrative.<br />
6 Select “Allow authentication from any domain in the forest.”<br />
If you select “Allow authentication from any domain in the forest,” you can add the<br />
Active <strong>Directory</strong> forest to the computer’s custom search policies for authentication and<br />
contacts. When you add an Active <strong>Directory</strong> forest to a custom search policy, the forest<br />
appears in the list of available directory domains as “/Active <strong>Directory</strong>/All Domains.”<br />
(This is the default setting.)<br />
If you deselect “Allow authentication from any domain in the forest,” you can add<br />
Active <strong>Directory</strong> domains individually to the computer’s custom search policies for<br />
authentication and contacts. When you add Active <strong>Directory</strong> domains to a custom<br />
search policy, each Active <strong>Directory</strong> domain appears separately in the list of available<br />
directory domains.<br />
7 Click OK.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 167
8 After selecting “Allow authentication from any domain in the forest,” change the<br />
custom search policy in the Authentication pane and Contacts pane to include the<br />
Active <strong>Directory</strong> forest or selected domains.<br />
For more information about changing a custom search policy, see “Defining Custom<br />
Search Policies” on page 130.<br />
Unbinding from the Active <strong>Directory</strong> <strong>Server</strong><br />
If the computer is using <strong>Directory</strong> Utility’s Active <strong>Directory</strong> plug-in to bind to an Active<br />
<strong>Directory</strong> server, you can unbind the computer from the Active <strong>Directory</strong> server.<br />
You can forcibly unbind if the computer can’t contact the server or if the computer<br />
record has been removed from the server.<br />
To unbind the computer from the Active <strong>Directory</strong> server:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select Active <strong>Directory</strong> and click the Edit (/) button.<br />
4 Click Unbind, authenticate as a user who has rights to terminate a connection to the<br />
Active <strong>Directory</strong> domain, and click OK.<br />
If you see an alert saying the credentials weren’t accepted or the computer can’t<br />
contact Active <strong>Directory</strong>, click Force Unbind to forcibly break the connection.<br />
If you forcibly unbind, Active <strong>Directory</strong> still contains a computer record for this<br />
computer. Notify the Active <strong>Directory</strong> administrator so the administrator knows to<br />
remove the computer record.<br />
5 In the Services pane, deselect Active <strong>Directory</strong>’s Enable setting, then click Apply.<br />
Editing User Accounts and Other Records in Active <strong>Directory</strong><br />
You can use Workgroup Manager to make changes to user accounts, group accounts,<br />
computer groups, and other records in an Active <strong>Directory</strong> domain. You can also use<br />
Workgroup Manager to delete records in an Active <strong>Directory</strong> domain.<br />
If the Active <strong>Directory</strong> schema has been extended to include standard <strong>Mac</strong> <strong>OS</strong> X record<br />
types (object classes) and attributes, you can use Workgroup Manager to create and<br />
edit computer groups in the Active <strong>Directory</strong> domain.<br />
For more information about working with user accounts, group accounts, and<br />
computer groups, see User Management.<br />
To create user or group accounts in an Active <strong>Directory</strong> domain, use the Microsoft<br />
Active <strong>Directory</strong> administration tools on a Windows server administration computer.<br />
168 Chapter 8 Advanced <strong>Directory</strong> Client Settings
Setting Up LDAP Access to Active <strong>Directory</strong> Domains<br />
Using <strong>Directory</strong> Utility, you can set up an LDAPv3 configuration to access an Active<br />
<strong>Directory</strong> domain on a Windows server. An LDAPv3 configuration gives you full control<br />
over mapping <strong>Mac</strong> <strong>OS</strong> X record types and attributes to Active <strong>Directory</strong> object classes,<br />
search bases, and attributes.<br />
Mapping some important <strong>Mac</strong> <strong>OS</strong> X record types and attributes, such as the unique<br />
user ID (UID), requires extending the Active <strong>Directory</strong> schema.<br />
An LDAPv3 configuration does not include the following features of the Active<br />
<strong>Directory</strong> plug-in listed in <strong>Directory</strong> Utility:<br />
 Dynamic generation of unique user ID and primary group ID<br />
 Creation of a local <strong>Mac</strong> <strong>OS</strong> X home folder<br />
 Automatic mounting of the Windows home folder<br />
 Mobile user accounts with cached authentication credentials<br />
 Discovery of all domains in an Active <strong>Directory</strong> forest<br />
 Support for Active <strong>Directory</strong> replication and failover<br />
For more information, see “About Active <strong>Directory</strong> Access” on page 157.<br />
To create an Active <strong>Directory</strong> server configuration:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select LDAPv3 and click the Edit (/) button.<br />
4 Click New and enter the Active <strong>Directory</strong> server’s DNS name or IP address.<br />
5 Select from the following options for accessing the directory, then click Continue to<br />
have <strong>Directory</strong> Utility get information from the Active <strong>Directory</strong> server.<br />
 Select “Encrypt using SSL” if you want <strong>Open</strong> <strong>Directory</strong> to use SSL for connections<br />
with the Active <strong>Directory</strong> server. Before you select the SSL checkbox, ask your <strong>Open</strong><br />
<strong>Directory</strong> administrator if SSL is needed.<br />
 Select “Use for authentication” if this directory contains users accounts that someone<br />
will use for logging in or authenticating to services.<br />
 Select “Use for contacts” if this directory contains mail addresses and other<br />
information you want to use in Address Book.<br />
If <strong>Directory</strong> Utility can’t contact the Active <strong>Directory</strong> server, a message appears and you<br />
must configure access manually or cancel the setup process. For more information, see<br />
“Configuring Access to an LDAP <strong>Directory</strong> Manually” on page 138.<br />
If you selected “Use for authentication” or “Use for contacts,” the LDAPv3 connection to<br />
the Active <strong>Directory</strong> domain is added to a custom search policy in the Authentication<br />
or Contacts pane of <strong>Directory</strong> Utility.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 169
Make sure LDAPv3 is enabled in the Services pane so the computer will use the<br />
connection you set up. For more information, see “Enabling or Disabling LDAP<br />
<strong>Directory</strong> Services” on page 133.<br />
6 When the dialog expands to display mappings options, choose Active <strong>Directory</strong> from<br />
the pop-up menu, enter the search base, then click Continue.<br />
The Active <strong>Directory</strong> mapping template for an LDAPv3 configuration maps some<br />
<strong>Mac</strong> <strong>OS</strong> X record types and attributes to object classes and attributes that are not part<br />
of a standard Active <strong>Directory</strong> schema. You can change the mappings defined by the<br />
template, or you can extend the Active <strong>Directory</strong> schema.<br />
Alternatively, you may be able to access your Active <strong>Directory</strong> domain through the<br />
Active <strong>Directory</strong> plug-in instead of LDAPv3. For more information, see “Configuring<br />
Access to an Active <strong>Directory</strong> Domain.”<br />
7 When the dialog expands to display connection options, enter the distinguished name<br />
and password of an Active <strong>Directory</strong> user account.<br />
8 Click OK to finish creating the LDAP connection.<br />
9 Click OK to finish configuring LDAPv3 options.<br />
Specifying NIS Settings<br />
Using <strong>Directory</strong> Utility, you can create a configuration that specifies how <strong>Mac</strong> <strong>OS</strong> X<br />
accesses a Network Information Service (NIS) domain.<br />
To create a configuration for accessing an NIS domain:<br />
1 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
2 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
3 In the list of services, select “BSD Flat File and NIS” and click the Edit (/) button.<br />
4 Enter the NIS domain name or the DNS name or the IP address of the server where the<br />
NIS domain resides.<br />
Include the NIS server’s hostname or IP address if it is required for security or if the<br />
server is not on the same subnet as the computer you’re configuring.<br />
If you don’t specify a server, NIS uses a broadcast protocol to discover an NIS server on<br />
the subnet.<br />
5 Select “Use NIS domain for authentication,” then click OK.<br />
The NIS domain is added to the computer’s authentication search policy as /BSD/<br />
domain, where domain is the name you entered in step 4.<br />
170 Chapter 8 Advanced <strong>Directory</strong> Client Settings
Specifying BSD Configuration File Settings<br />
Historically, UNIX computers have stored administrative data in configuration files such<br />
as /etc/master.passwd, /etc/group, and /etc/hosts. <strong>Mac</strong> <strong>OS</strong> X is based on a BSD version<br />
of UNIX, but normally gets administrative data from directory systems.<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> supports a fixed set of BSD configuration files. You can’t specify which<br />
configuration files to use, nor can you map their contents to <strong>Mac</strong> <strong>OS</strong> X record types and<br />
attributes.<br />
In <strong>Mac</strong> <strong>OS</strong> X v10.2 or later (including <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.2 or later), <strong>Open</strong> <strong>Directory</strong><br />
can retrieve administrative data from BSD configuration files. This capability enables<br />
organizations that have BSD configuration files to use copies of the existing files on<br />
<strong>Mac</strong> <strong>OS</strong> X computers. BSD configuration files can be used alone or with other directory<br />
domains.<br />
To use BSD configuration files:<br />
1 Make sure the BSD configuration files contain the data required by <strong>Mac</strong> <strong>OS</strong> X directory<br />
services.<br />
For more information, see “Setting Up Data in BSD Configuration Files” on page 171.<br />
2 <strong>Open</strong> <strong>Directory</strong> Utility and click Services.<br />
3 If the lock icon is locked, unlock it by clicking it and entering the name and password<br />
of an administrator.<br />
4 In the list of services, select “BSD Flat File and NIS” and click the Edit (/) button.<br />
5 Select “Use User and Group records in BSD local node,” then click OK.<br />
The BSD configuration files domain is added to the computer’s authentication search<br />
policy as /BSD/local.<br />
Setting Up Data in BSD Configuration Files<br />
If you want a <strong>Mac</strong> <strong>OS</strong> X computer to get administrative data from BSD configuration<br />
files, the data must exist in the files and must be in the format required by <strong>Mac</strong> <strong>OS</strong> X.<br />
You might need to add, change, or reorganize data in the files. Workgroup Manager<br />
cannot make changes to data in BSD configuration files, so you must make the<br />
necessary modifications by using a text editor or other tools.<br />
Chapter 8 Advanced <strong>Directory</strong> Client Settings 171
The following table lists the names of the files and describes the content in them.<br />
BSD configuration file<br />
/etc/master.passwd<br />
/etc/group<br />
/etc/fstab<br />
/etc/hosts<br />
/etc/networks<br />
/etc/services<br />
/etc/protocols<br />
/etc/rpcs<br />
/etc/printcap<br />
/etc/bootparams<br />
/etc/bootp<br />
/etc/aliases<br />
/etc/netgroup<br />
Contains<br />
User names, passwords, IDs, primary group IDs, and so forth<br />
Group names, IDs, and members<br />
NFS mounts<br />
Computer names and addresses<br />
Network names and addresses<br />
Service names, ports, and protocols<br />
IP protocol names and numbers<br />
<strong>Open</strong> Network Computing RPC servers<br />
Printer names and capabilities<br />
Bootparam settings<br />
Bootp settings<br />
Mail aliases and distribution lists<br />
Network-wide group names and members<br />
For more information about the data required by <strong>Mac</strong> <strong>OS</strong> X directory services, see the<br />
Appendix, “<strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data.”<br />
172 Chapter 8 Advanced <strong>Directory</strong> Client Settings
9 Maintaining<br />
<strong>Open</strong> <strong>Directory</strong><br />
Services<br />
9<br />
You can monitor <strong>Open</strong> <strong>Directory</strong> services, view and edit raw<br />
data from <strong>Open</strong> <strong>Directory</strong> domains, and back up <strong>Open</strong><br />
<strong>Directory</strong> files.<br />
Ongoing tasks in managing <strong>Open</strong> <strong>Directory</strong> services include the following:<br />
 “Controlling Access to <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>s and Services” on page 173<br />
 “Monitoring <strong>Open</strong> <strong>Directory</strong>” on page 177<br />
 “Viewing and Editing <strong>Directory</strong> Data” on page 179<br />
 “Importing Records of Any Type” on page 183<br />
 “Setting Options for an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>” on page 183<br />
 “Managing <strong>Open</strong> <strong>Directory</strong> Replication” on page 189<br />
 “Archiving an <strong>Open</strong> <strong>Directory</strong> Master” on page 194<br />
 “Restoring an <strong>Open</strong> <strong>Directory</strong> Master” on page 195<br />
For information about solving <strong>Open</strong> <strong>Directory</strong> problems, see “Solving <strong>Open</strong> <strong>Directory</strong><br />
Problems” on page 199.<br />
Controlling Access to <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>s and Services<br />
You can control access to an <strong>Open</strong> <strong>Directory</strong> master or replica by restricting who can<br />
log in using the login window or the ssh command-line tool. For more information,<br />
see:<br />
 “Controlling Access to a <strong>Server</strong>’s Login Window” on page 174<br />
 “Controlling Access to SSH Service” on page 174<br />
 “Configuring Service Access Control” on page 175<br />
 “Configuring Record Privileges” on page 176<br />
173
Controlling Access to a <strong>Server</strong>’s Login Window<br />
You can use <strong>Server</strong> Admin to control which users can log in to <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> using<br />
the login window. Users with server administrator privileges can always log in to the<br />
server.<br />
To control who can use the login window on a server:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click Setting, then click Access.<br />
3 Click Services.<br />
4 Select “For selected services below” and select Login Window in the list on the left.<br />
5 Select “Allow only users and groups below” and edit the list of users and groups that<br />
you want to log in using the server’s login window:<br />
 Add users or groups that can use the login window by clicking the Add (+) button<br />
and supplying the requested information.<br />
 Remove users or groups from the list by selecting one or more and clicking the<br />
Remove (–) button.<br />
6 Click Save.<br />
If “Allow all users and groups” is selected when you select “For selected services below”<br />
in step 4, all services except login window will permit access to all users and groups.<br />
If you want to restrict who can access a listed service in addition to login window,<br />
select the service in the list, select “Allow only users and groups below,” and add users<br />
and groups to the list.<br />
If you want all users to log in using the server’s login window, select Login Window,<br />
then select “Allow all users and groups.”<br />
Controlling Access to SSH Service<br />
You can use <strong>Server</strong> Admin to control which users can open a command-line<br />
connection to <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> using the ssh command in Terminal. Users with server<br />
administrator privileges can always open a connection using ssh.<br />
The ssh command uses the secure shell (SSH) service. For information about using the<br />
ssh command, see Command-Line <strong>Administration</strong>.<br />
To control who can open an SSH connection to a remote server:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click Setting, then click Access.<br />
3 Click Services.<br />
4 Select “For selected services below” and select SSH in the list on the left.<br />
174 Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services
5 Select “Allow only users and groups below” and edit the list of users and groups that<br />
you want to have SSH access to the server:<br />
 Add users or groups that can open SSH connections by clicking the Add (+) button<br />
and supplying the requested information.<br />
 Remove users or groups from the list by selecting one or more and clicking the<br />
Remove (–) button.<br />
6 Click Save.<br />
If “Allow all users and groups” is selected when you select “For selected services below”<br />
in step 4, all services except SSH will permit access to all users and groups.<br />
If you want to restrict who can access a listed service besides SSH, select the service in<br />
the list, select “Allow only users and groups below,” and add user and groups to the list.<br />
If you want all users to be able to open an SSH connection to the server, select SSH,<br />
then select “Allow all users and groups.”<br />
Configuring Service Access Control<br />
You can configure service access control lists (SACLs) using <strong>Server</strong> Admin. SACLs enable<br />
you to specify which administrators have access to <strong>Open</strong> <strong>Directory</strong>.<br />
SACLs provide you with greater control over which administrators have access to<br />
monitor and manage the service. Only users and groups listed in an SACL have access<br />
to the corresponding service. For example, if you want to give administrator access to<br />
users or groups for the <strong>Open</strong> <strong>Directory</strong> service on your server, add them to the <strong>Open</strong><br />
<strong>Directory</strong> SACL.<br />
To set administrator SACL permissions for <strong>Open</strong> <strong>Directory</strong> service:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click Settings, then click Access.<br />
3 Click Administrators.<br />
4 Select the level of restriction that you want for the services.<br />
To restrict access to all services, select “For all services.”<br />
To set access permissions for individual services, select “For selected services below”<br />
and then select <strong>Open</strong> <strong>Directory</strong> from the Service list.<br />
5 Click the Add (+) button to open the Users and Groups drawer.<br />
6 Drag users and groups from the Users and Groups drawer to the list.<br />
7 Set the users permission.<br />
To grant administrator access, choose Administrator from the Permission pop-up menu<br />
next to the user name.<br />
Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services 175
To grant monitoring access, choose Monitor from the Permission pop-up menu next to<br />
the user name.<br />
8 Click Save.<br />
Configuring Record Privileges<br />
You can configure record privileges using <strong>Server</strong> Admin. These privileges enable you to<br />
specify which users or groups can administer record types and attributes in the<br />
directory domain database.<br />
To configure privileges for record types and attributes:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click Privileges.<br />
5 Select the records types and attributes from the Record list that you want users or<br />
groups to administer.<br />
Administer means that the user can modify the characteristics of an existing record.<br />
To permit selected users to administer all records, select “For all records.”<br />
To permit selected users to administer specific records, select “For selected records<br />
below” and then select the records you want your users to administer.<br />
6 Click the Add (+) button to open the Users and Groups drawer.<br />
7 Drag users and groups from the Users and Groups drawer to the list.<br />
The users you add to the list will have privileges to administer that record.<br />
8 Select the records types and attributes from the Record list that you want users or<br />
groups to create.<br />
Create means that the user can create that type of record (for example, creating a<br />
conference room).<br />
To permit selected users to create all records, select “For all records.”<br />
To permit selected users to create specific records, select “For selected records below”<br />
and then select the records you want your users to create.<br />
9 Click the Add (+) button to open the Users and Groups drawer.<br />
10 Drag users and groups from the Users and Groups drawer to the list.<br />
The users you add to the list will have privileges to create that record.<br />
11 Click Save.<br />
176 Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services
Monitoring <strong>Open</strong> <strong>Directory</strong><br />
You can view <strong>Open</strong> <strong>Directory</strong> status and logs, and you can inspect <strong>Open</strong> <strong>Directory</strong><br />
authentication logs for suspicious activities.<br />
For task instructions, see:<br />
 “Checking the Status of an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>” on page 177<br />
 “Monitoring Replicas and Replays of an <strong>Open</strong> <strong>Directory</strong> Master” on page 177<br />
 “Viewing <strong>Open</strong> <strong>Directory</strong> Status and Logs” on page 178<br />
 “Monitoring <strong>Open</strong> <strong>Directory</strong> Authentication” on page 178<br />
Checking the Status of an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong><br />
Using <strong>Server</strong> Admin, you can confirm that the <strong>Open</strong> <strong>Directory</strong> master is functioning<br />
properly.<br />
To check the status of an open <strong>Directory</strong> server:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Overview.<br />
5 Make sure the status of all items listed in the <strong>Open</strong> <strong>Directory</strong> overview pane is<br />
“Running.”<br />
If any item is stopped, click Refresh (or choose View > Refresh). If Kerberos remains<br />
stopped, see “If Kerberos Is Stopped on an <strong>Open</strong> <strong>Directory</strong> Master or Replica” on<br />
page 199.<br />
Monitoring Replicas and Replays of an <strong>Open</strong> <strong>Directory</strong> Master<br />
Using <strong>Server</strong> Admin, you can check the status of replica creation and of ongoing<br />
replication.<br />
To monitor replicas or relays of an <strong>Open</strong> <strong>Directory</strong> master:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click General, to see a list of replicas and the status of each one.<br />
The status for a new replica indicates whether it was created successfully. Thereafter,<br />
the status indicates whether the most recent replication attempt was successful.<br />
Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services 177
Viewing <strong>Open</strong> <strong>Directory</strong> Status and Logs<br />
You can use <strong>Server</strong> Admin to view status information and logs for <strong>Open</strong> <strong>Directory</strong><br />
services. The following logs are available:<br />
 <strong>Directory</strong> services server log<br />
 <strong>Directory</strong> services error log<br />
 kadmin log<br />
 kdc log<br />
 LDAP log<br />
 Password service server log<br />
 Password service error log<br />
 Password service replication log<br />
 slapconfig log<br />
To see directory services status or logs:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Overview to see status information.<br />
5 Click Logs and use the View pop-up menu to choose the log you want to see.<br />
The path to the log file is displayed above the log.<br />
6 Optionally, enter text in the filter field and press Return to show only lines containing<br />
the text you entered.<br />
Monitoring <strong>Open</strong> <strong>Directory</strong> Authentication<br />
You can use password service logs, visible using <strong>Server</strong> Admin, to monitor failed login<br />
attempts for suspicious activity.<br />
<strong>Open</strong> <strong>Directory</strong> uses logs to record failed authentication attempts, including IP<br />
addresses that generate them. Periodically review the logs to determine whether there<br />
are a large number of failed trials for the same password ID, indicating that somebody<br />
might be generating login guesses.<br />
To see <strong>Open</strong> <strong>Directory</strong> authentication logs:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
178 Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services
4 Click Logs and choose the kdc log or a password service log from the View pop-up<br />
menu.<br />
Viewing and Editing <strong>Directory</strong> Data<br />
You can view or edit raw directory data by using the Inspector in Workgroup Manager.<br />
When using the Inspector you can see directory data that is not otherwise visible in<br />
Workgroup Manager.<br />
The Inspector can edit directory data that you cannot otherwise change in Workgroup<br />
Manager. For example, you can use the Inspector to change a user’s first short name.<br />
For more information, see:<br />
 “Showing the <strong>Directory</strong> Inspector” on page 179<br />
 “Hiding the <strong>Directory</strong> Inspector” on page 180<br />
 “Setting <strong>Directory</strong> Access Controls (DACs)” on page 180<br />
 “Deleting Records” on page 180<br />
 “Deleting Users or Computers Using Inspector or the Command Line” on page 181<br />
 “Changing a User’s Short Name” on page 182<br />
Showing the <strong>Directory</strong> Inspector<br />
You can make the Inspector visible in Workgroup Manager by selecting an option in<br />
Workgroup Manager Preferences. Then you can use the Inspector to view or edit raw<br />
directory data.<br />
WARNING: Changing raw data in a directory can have unexpected and undesirable<br />
consequences. You could inadvertently incapacitate users or computers, or you could<br />
unintentionally authorize users to access more resources.<br />
To make the Inspector visible:<br />
1 <strong>Open</strong> Workgroup Manager.<br />
2 Choose Workgroup Manager > Preferences.<br />
3 Select “Show ‘All Records’ tab and inspector” and click OK.<br />
4 To see user, group, computer, or computer group attributes, click the Users, Group,<br />
Computer, or Computer Group button, then click Inspector (on the right).<br />
5 To see other types of records, click the All Records button next to the Computer Group<br />
button, and choose a record type from the pop-up menu at the top of the list.<br />
The pop-up menu lists all standard record types that exist in the directory domain. You<br />
can also choose Native from the pop-up menu and enter the name of a native record<br />
in the box that appears below the pop-up menu. The list displays all records, including<br />
predefined records, of the record type.<br />
Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services 179
Hiding the <strong>Directory</strong> Inspector<br />
If the Inspector is visible in Workgroup Manager, you can hide it by changing an option<br />
in Workgroup Manager Preferences.<br />
To hide the Inspector:<br />
1 <strong>Open</strong> Workgroup Manager.<br />
2 Choose Workgroup Manager > Preferences.<br />
3 Deselect “Show ‘All Records’ tab and inspector” and click OK.<br />
Setting <strong>Directory</strong> Access Controls (DACs)<br />
<strong>Open</strong> <strong>Directory</strong> provides the ability to define directory access controls (DACs) to all<br />
parts of the LDAP directory, providing control of who has permission to change what.<br />
<strong>Open</strong> <strong>Directory</strong> stores DACs in an apple-acl record that you can edit using the<br />
Inspector in Workgroup Manager.<br />
To change DACs:<br />
1 <strong>Open</strong> Workgroup Manager and make the Inspector visible if it is hidden.<br />
For more information, see “Showing the <strong>Directory</strong> Inspector” on page 179.<br />
2 <strong>Open</strong> the directory domain whose access controls you want to set, and authenticate as<br />
an administrator of the domain.<br />
To open a directory domain, click the small globe icon above the list of users and<br />
choose from the pop-up menu.<br />
3 Click the All Records button (next to the Computer Group button) and then from the<br />
pop-up menu at the top of the list choose AccessControls.<br />
4 In the list of records, select “default.”<br />
5 In the list of attributes, select Locate AccessControlEntry and if a triangle appears next<br />
to AccessControlEntry, click the triangle to see all access control entries.<br />
6 Select an AccessControlEntry, then click Edit to change the value or click New Value to<br />
add an AccessControlEntry value.<br />
You can also double-click a value to edit it in place.<br />
7 Click Save.<br />
Deleting Records<br />
You can use the Inspector in Workgroup Manager to delete a record.<br />
WARNING: After using the Inspector to delete user or computer records, use<br />
command-line tools to delete the corresponding Kerberos identity and Password<br />
<strong>Server</strong> slot. If you leave an orphaned Kerberos identity or Password <strong>Server</strong> slot, it can<br />
conflict with a user or computer record created later.<br />
180 Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services
WARNING: Deleting records can cause the server to behave erratically or stop<br />
working. Don’t delete records unless you know they’re not needed for proper server<br />
functioning.<br />
To delete records with the Inspector:<br />
1 <strong>Open</strong> Workgroup Manager and make the Inspector visible if it is hidden.<br />
For more information, see “Showing the <strong>Directory</strong> Inspector” on page 179.<br />
2 <strong>Open</strong> the directory domain where you want to delete a record, and authenticate as an<br />
administrator of the domain.<br />
To open a directory domain, click the small globe icon above the list of users and<br />
choose from the pop-up menu.<br />
3 Click the All Records button (next to the Computer Group button) and then from the<br />
pop-up menu at the top of the list choose a record type.<br />
4 In the list of records, select one or more records you want to delete.<br />
5 Click Delete (or choose <strong>Server</strong> > Delete Selected Records).<br />
Deleting Users or Computers Using Inspector or the Command Line<br />
If you use the Inspector in Workgroup Manager or command-line tools in Terminal to<br />
delete a user or computer record whose AuthenticationAuthority attribute includes a<br />
Password <strong>Server</strong> or Kerberos value, delete the corresponding Kerberos identity and<br />
Password <strong>Server</strong> slot.<br />
If you leave an orphaned Kerberos identity in the Kerberos KDC or an orphaned<br />
Password <strong>Server</strong> slot, it can conflict with a user or computer record created later.<br />
If the AuthenticationAuthority attribute includes a value beginning with ;Kerberosv5;<br />
use the delete_principal command of the kadmin.local command-line tool in<br />
Terminal to delete the corresponding Kerberos identity from the Kerberos KDC. For<br />
more information, see the kadmin.local man page.<br />
If the AuthenticationAuthority attribute includes a value beginning with<br />
;<strong>Apple</strong>Password<strong>Server</strong>; use the -deleteslot command of the mkpassdb command-line<br />
tool in Terminal to delete the corresponding Password <strong>Server</strong> slot. For more<br />
information, see the mkpassdb man page.<br />
If you delete a user account in Workgroup Manager by clicking the User button (not<br />
the All Records button) on the left, selecting the user account, and clicking Delete in<br />
the Workgroup Manager toolbar (or by choosing <strong>Server</strong> > Delete Selected User),<br />
Workgroup Manager removes the user account’s Password <strong>Server</strong> slot and Kerberos<br />
identity for you.<br />
Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services 181
Likewise, if you delete a computer record by selecting it in a computer group and<br />
clicking the Delete (–) button, Workgroup Manager removes the computer record’s<br />
Password <strong>Server</strong> slot and Kerberos identity for you.<br />
Changing a User’s Short Name<br />
To change a user’s first short name, you can use the ldapmodrdn command-line tool in<br />
Terminal. Any short name except the first name can be changed in the Basic pane of a<br />
Workgroup Manager user window.<br />
WARNING: Changing a user’s first short name can have unexpected and undesirable<br />
consequences. Other services use each user’s first short name as a unique and<br />
persistent identifier.<br />
For example, changing a user’s first short name does not rename the user’s home<br />
folder. The user has the same home folder (even though its name doesn’t match the<br />
user’s new first short name) unless the user accesses his or her home folder through a<br />
group membership.<br />
The following example shows how to change the short name of a user account using<br />
ldapmodrdn:<br />
$ ldapmodrdn -U diradmin -Y "cram-md5" -W -r<br />
"uid=oldshortname,cn=users,dc=example,dc=com" "uid=newshortname"<br />
This example assumes you’re using Terminal on the <strong>Open</strong> <strong>Directory</strong> master server or<br />
you’ve set up an SSH connection to the <strong>Open</strong> <strong>Directory</strong> master server using Terminal<br />
on another computer.<br />
In the example, you replace diradmin with the name of a directory administrator,<br />
oldshortname with the short name that you want changed, and newshortname with the<br />
new short name.<br />
You must also replace dc=example,dc=com with the server’s search base suffix. You can<br />
determine the server’s search base suffix by looking at the Protocols settings pane of<br />
the <strong>Open</strong> <strong>Directory</strong> service in <strong>Server</strong> Admin.<br />
If you use ldapmodrdn to change the first short name of a user record with multiple<br />
short names, the record’s second short name becomes the first short name and the<br />
new short name becomes the record’s last short name.<br />
To reorder short names, use the ldapmodify command-line tool. For more information,<br />
see the ldapmodify man page.<br />
182 Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services
Importing Records of Any Type<br />
Workgroup Manager can import all types of records into the LDAP directory of an<br />
<strong>Open</strong> <strong>Directory</strong> master. This includes users, groups, computer groups, computers, and<br />
all other standard <strong>Mac</strong> <strong>OS</strong> X record types.<br />
Important: If you import user or group records from a file exported by <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
v10.3 or earlier, each imported record is assigned a globally unique ID (GUID).<br />
To make sure that GUIDs and their relationships to specific users and groups remain<br />
the same (if you need to reimport the same users and groups), create an export file<br />
using Workgroup Manager in <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong>. Use the <strong>v10.5</strong> export file instead of<br />
the export file created using the earlier server version.<br />
For a list of record types and attributes that can be imported, see the following file:<br />
/System/Library/Frameworks/<strong>Directory</strong>Service.framework/Headers/DirServicesConst.h<br />
For information about well-known record types and attributes, see “Standard <strong>Open</strong><br />
<strong>Directory</strong> Record Types and Attributes” on page 253.<br />
For more information about exporting users and groups using Workgroup Manager<br />
and on importing records of any type, see User Management.<br />
Setting Options for an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong><br />
You can set binding, security, and password policies for an <strong>Open</strong> <strong>Directory</strong> master and<br />
its replicas. You can also can set several LDAP options for an <strong>Open</strong> <strong>Directory</strong> master or<br />
replica. For more information, see the following:<br />
 “Setting a Binding Policy for an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>” on page 184<br />
 “Setting a Security Policy for an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>” on page 184<br />
 “Changing the Global Password Policy” on page 111<br />
 “Changing the Location of an LDAP Database” on page 186<br />
 “Limiting Search Results for LDAP Service” on page 186<br />
 “Setting the Search Timeout Interval for LDAP Service” on page 187<br />
 “Setting up SSL for LDAP Service” on page 187<br />
 “Creating a Custom SSL Configuration for LDAP” on page 188<br />
Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services 183
Setting a Binding Policy for an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong><br />
Using <strong>Server</strong> Admin, you can configure an <strong>Open</strong> <strong>Directory</strong> master to permit or require<br />
trusted binding between the LDAP directory and the computers that access it. Replicas<br />
of an <strong>Open</strong> <strong>Directory</strong> master automatically inherit the master’s binding policy.<br />
Trusted LDAP binding is mutually authenticated. The computer proves its identity by<br />
using an LDAP directory administrator’s name and password to authenticate to the<br />
LDAP directory. The LDAP directory proves its authenticity by means of an<br />
authenticated computer record created in the directory when you set up trusted<br />
binding.<br />
Clients can’t be configured to use both trusted LDAP binding and a DHCP-supplied<br />
LDAP server (also known as DHCP option 95). Trusted LDAP binding is inherently a<br />
static binding, but DHCP-supplied LDAP is a dynamic binding. For more information,<br />
see “Enabling or Disabling Use of a DHCP-Supplied LDAP <strong>Directory</strong>” on page 134.<br />
Note: To use trusted LDAP binding, clients need v10.4 or later of <strong>Mac</strong> <strong>OS</strong> X or <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong>. Clients using v10.3 or earlier can’t set up trusted binding.<br />
To set the binding policy for an <strong>Open</strong> <strong>Directory</strong> master:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the <strong>Open</strong> <strong>Directory</strong> master server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click Policy.<br />
5 Click Binding, then set the directory binding options you want:<br />
 To permit trusted binding, select “Enable authenticated directory binding.”<br />
 To require trusted binding, also select “Require authenticated binding between<br />
directory and clients.”<br />
6 Click Save.<br />
Important: If you enable “Encrypt all packets (requires SSL or Kerberos)” and “Enable<br />
authenticated directory binding,”make sure that your users are using one or the other<br />
for binding and not both.<br />
Setting a Security Policy for an <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong><br />
Using <strong>Server</strong> Admin, you can configure a security policy for access to the LDAP<br />
directory of an <strong>Open</strong> <strong>Directory</strong> master.<br />
Replicas of the <strong>Open</strong> <strong>Directory</strong> master automatically inherit the master’s security policy.<br />
184 Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services
Note: If you change the security policy for the LDAP directory of an <strong>Open</strong> <strong>Directory</strong><br />
master, you must disconnect and reconnect (unbind and rebind) every computer<br />
connected (bound) to this LDAP directory. Use the <strong>Directory</strong> Utility as described in<br />
“Removing a <strong>Directory</strong> <strong>Server</strong> Connection” on page 122 and “Adding an <strong>Open</strong> <strong>Directory</strong><br />
<strong>Server</strong> Connection” on page 121.<br />
To set the security policy for an <strong>Open</strong> <strong>Directory</strong> master:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the <strong>Open</strong> <strong>Directory</strong> master server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click Policy.<br />
5 Click Binding, then set the security options you want:<br />
 “Disable clear text passwords” determines whether clients can send passwords as<br />
clear text if the passwords can’t be validated using any authentication method that<br />
sends an encrypted password. For more information, see “Selecting Authentication<br />
Methods for Shadow Password Users” on page 113 and “Selecting Authentication<br />
Methods for <strong>Open</strong> <strong>Directory</strong> Passwords” on page 114.<br />
 “Digitally sign all packets (requires Kerberos)” certifies that directory data from the<br />
LDAP server won’t be intercepted and modified by another computer while en route<br />
to client computers.<br />
 “Encrypt all packets (requires SSL or Kerberos)” requires the LDAP server to encrypt<br />
directory data using SSL or Kerberos before sending it to client computers.<br />
 “Block man-in-the-middle attacks (requires Kerberos)” protects against a rogue<br />
server posing as the LDAP server. Best if used with the “Digitally sign all packets”<br />
option.<br />
 “Disable client-side caching” prevents client computers from caching LDAP data<br />
locally.<br />
 “Allow users to edit their own contact information” permits users to change contact<br />
information on the LDAP server.<br />
6 Click Save.<br />
Important: If you enable “Encrypt all packets (requires SSL or Kerberos)” and “Enable<br />
authenticated directory binding,” make sure that your users are using one or the other<br />
for binding and not both.<br />
Based on the settings here, the security options can also be configured on each client<br />
of an <strong>Open</strong> <strong>Directory</strong> master or replica. If an option is selected here, it can’t be<br />
deselected for a client. For more information about configuring these options on a<br />
client, see “Changing the Security Policy for an LDAP Connection” on page 145.<br />
Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services 185
Changing the Location of an LDAP Database<br />
Using <strong>Server</strong> Admin, you can specify the disk location of the database that stores user<br />
records and other information in an LDAP directory domain of an <strong>Open</strong> <strong>Directory</strong><br />
master or replica. The LDAP database is usually on the startup volume but can be on a<br />
different local volume.<br />
Note: For security purposes, databases that store authentication information for <strong>Open</strong><br />
<strong>Directory</strong> and Kerberos are always on the startup volume regardless of the LDAP<br />
database location.<br />
To change the location of an LDAP database:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the <strong>Open</strong> <strong>Directory</strong> master or an <strong>Open</strong> <strong>Directory</strong><br />
replica server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click LDAP.<br />
5 From the Configure pop-up menu, choose LDAP Settings, then specify the folder path<br />
where you want the LDAP database to be located.<br />
You can enter a folder path in the Database field or you can select a folder location by<br />
clicking Choose and browsing to a location you want the folder located.<br />
6 Click Save.<br />
Limiting Search Results for LDAP Service<br />
Using <strong>Server</strong> Admin, you can prevent one type of denial-of-service attack on <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> by limiting the number of search results returned by the server’s shared LDAP<br />
directory domain. Limiting the number of search results prevents a malicious user from<br />
tying up the server by sending it multiple all-inclusive LDAP search requests.<br />
To limit LDAP search results:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the <strong>Open</strong> <strong>Directory</strong> master or an <strong>Open</strong> <strong>Directory</strong><br />
replica server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click LDAP.<br />
5 From the Configure pop-up menu, choose LDAP Settings, then enter the maximum<br />
number of returned search results in the “Return a maximum of __ search results” field.<br />
6 Click Save.<br />
186 Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services
Setting the Search Timeout Interval for LDAP Service<br />
Using <strong>Server</strong> Admin, you can prevent one type of denial-of-service attack on <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> by limiting the amount of time the server spends on one search of its shared<br />
LDAP directory domain.<br />
Setting a search timeout prevents a malicious user from tying up the server by sending<br />
it an exceptionally complex LDAP search request.<br />
To set a search timeout interval for LDAP service:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the <strong>Open</strong> <strong>Directory</strong> master or an <strong>Open</strong> <strong>Directory</strong><br />
replica server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click LDAP.<br />
5 From the Configure pop-up menu, choose LDAP Settings, then specify a search timeout<br />
interval in the “Search times out in __” field.<br />
Set the time interval using the pop-up menu.<br />
6 Click Save.<br />
Setting up SSL for LDAP Service<br />
Using <strong>Server</strong> Admin, you can enable Secure Sockets Layer (SSL) for encrypted<br />
communications between an <strong>Open</strong> <strong>Directory</strong> server’s LDAP directory domain and<br />
computers that access it. SSL uses a digital certificate to provide a certified identity for<br />
the server. You can use a self-signed certificate or a certificate obtained from a<br />
certificate authority.<br />
For complete information about defining, obtaining, and installing certificates on your<br />
server, see <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> Security Configuration.<br />
SSL communications for LDAP use port 636. If SSL is disabled for LDAP service,<br />
communications are sent as clear text on port 389.<br />
To set up SSL communications for LDAP service:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the <strong>Open</strong> <strong>Directory</strong> master or an <strong>Open</strong> <strong>Directory</strong><br />
replica server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click LDAP.<br />
5 From the Configure pop-up menu, choose LDAP Settings, then select Enable SSL.<br />
Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services 187
6 Use the Certificate pop-up menu to choose an SSL certificate that you want LDAP<br />
service to use.<br />
The menu lists all SSL certificates that have been installed on the server. To use a<br />
certificate not listed, choose Custom Configuration from the pop-up menu.<br />
7 Click Save.<br />
Creating a Custom SSL Configuration for LDAP<br />
SSL uses a digital certificate to provide a certified identity for the server. You can use<br />
custom digital certificates to configure SSL for your network environment.The following<br />
steps describe the command-line method for creating custom certificates and provide<br />
instructions for implementing them in <strong>Server</strong> Admin.<br />
To create an <strong>Open</strong> <strong>Directory</strong> service certificate:<br />
1 Generate a private key for the server in the /usr/share/certs/ folder:<br />
If the /usr/share/certs folder does not exist create it.<br />
$ sudo openssl genrsa -out ldapserver.key 2048<br />
2 Generate a certificate signing request (CSR) for the certificate authority (CA) to sign:<br />
$ sudo openssl req -new -key ldapserver.key -out ldapserver.csr<br />
3 Fill out the following fields as completely as possible, making certain that the Common<br />
Name field matches the domain name of the LDAP server exactly, and leaving the<br />
challenge password and optional company name blank:<br />
Country Name:<br />
Organizational Unit:<br />
State or Province Name:<br />
Common Name:<br />
Locality Name (city):<br />
Email Address:<br />
Organization Name:<br />
4 Sign the ldapserver.csr request with the openssl command.<br />
$ sudo openssl ca -in ldapserver.csr -out ldapserver.crt<br />
5 When prompted, enter the CA passphrase to continue and complete the process.<br />
The certificate files needed to enable SSL on the LDAP server are now in the<br />
/usr/share/certs/ folder.<br />
6 <strong>Open</strong> <strong>Server</strong> Admin and connect to the <strong>Open</strong> <strong>Directory</strong> master or an <strong>Open</strong> <strong>Directory</strong><br />
replica server.<br />
7 Click the triangle to the left of the server.<br />
The list of services appears.<br />
8 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
9 Click Settings, then click LDAP.<br />
188 Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services
10 From the Configure pop-up menu choose “LDAP Settings.”<br />
11 Select Enable Secure Sockets Layer (SSL).<br />
12 Use the Certificate pop-up menu to choose an SSL certificate that you want LDAP<br />
service to use.<br />
The menu lists all SSL certificates that have been installed on the server. To use a<br />
certificate not listed, choose Custom Configuration from the pop-up menu.<br />
13 Click Save.<br />
Managing <strong>Open</strong> <strong>Directory</strong> Replication<br />
You can schedule <strong>Open</strong> <strong>Directory</strong> replication or replicate on demand, promote a replica<br />
to a master, or take a replica out of service.<br />
For more information, see:<br />
 “Scheduling Replication of an <strong>Open</strong> <strong>Directory</strong> Master or Primary Domain Controller<br />
(PDC)” on page 189<br />
 “Synchronizing an <strong>Open</strong> <strong>Directory</strong> Replica or BDC on Demand” on page 190<br />
 “Making an <strong>Open</strong> <strong>Directory</strong> Replica into a Relay” on page 190<br />
 “Promoting an <strong>Open</strong> <strong>Directory</strong> Replica” on page 190<br />
 “Decommissioning an <strong>Open</strong> <strong>Directory</strong> Replica” on page 193<br />
Scheduling Replication of an <strong>Open</strong> <strong>Directory</strong> Master or Primary<br />
Domain Controller (PDC)<br />
Using <strong>Server</strong> Admin, you can specify how frequently an <strong>Open</strong> <strong>Directory</strong> master updates<br />
its replicas with changes to directory and authentication information. The master can<br />
update the replicas when a change occurs in the master directory domain or by<br />
following a schedule you specify.<br />
The same steps are used if you set up your <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> as a PDC. You set the<br />
schedule for PDC replication to the backup domain controller (BDC) by scheduling<br />
<strong>Open</strong> <strong>Directory</strong> replication.<br />
To schedule how frequently an <strong>Open</strong> <strong>Directory</strong> master or PDC updates its replicas or<br />
BDCs:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the <strong>Open</strong> <strong>Directory</strong> master or PDC server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click General.<br />
Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services 189
5 Specify a replication frequency:<br />
 “Replicate to clients whenever the directory is modified:” Keeps replicas updated<br />
with real-time changes, but increases network load. Can impair the performance of<br />
the master if a replica is connected through a slow network link.<br />
 “Replicate to clients every __:” Allows you to schedule less frequent updates (by<br />
specifying a longer interval). Less frequent updates trades less accuracy of replicas for<br />
fewer network connections between the master and its replicas. If replicas are not all<br />
on the same LAN as the master, fewer network connections can be desirable.<br />
6 Click Save.<br />
Synchronizing an <strong>Open</strong> <strong>Directory</strong> Replica or BDC on Demand<br />
Although an <strong>Open</strong> <strong>Directory</strong> master or PDC synchronizes its directory and<br />
authentication data with registered replicas or BDCs, you can use <strong>Server</strong> Admin to<br />
synchronize the data with a selected replica or BDC on demand.<br />
To synchronize an <strong>Open</strong> <strong>Directory</strong> replica or BDC on demand:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the <strong>Open</strong> <strong>Directory</strong> master or PDC server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click General.<br />
5 Select a replica or BDC in the list, then click Replicate Now.<br />
Making an <strong>Open</strong> <strong>Directory</strong> Replica into a Relay<br />
There is not much difference between a relay and replica. Both have a read-only copy<br />
of the <strong>Open</strong> <strong>Directory</strong> master’s LDAP directory domain and also a read/write copy of<br />
the <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> and the Kerberos Key Distribution Center (KDC).<br />
A relay is a direct member replica of a <strong>Open</strong> <strong>Directory</strong> master and it has replicas that it<br />
replicates to.<br />
You can make an <strong>Open</strong> <strong>Directory</strong> replica into a relay by ensuring the following:<br />
 The replica must be a direct replica of the <strong>Open</strong> <strong>Directory</strong> master (first-tier).<br />
 The replica must have replicas (supports up to 32 replicas).<br />
For more information about relays, see “Cascading Replication” on page 64.<br />
Promoting an <strong>Open</strong> <strong>Directory</strong> Replica<br />
If an <strong>Open</strong> <strong>Directory</strong> master fails and you cannot recover it from a backup, you can<br />
promote a replica to be a master. The new master (promoted replica) uses the directory<br />
and authentication databases of the replica.<br />
190 Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services
After doing this, you must convert all other replicas of the old master to standalone<br />
directory services and then make them replicas of the new master.<br />
Important: Use this procedure only to replace an <strong>Open</strong> <strong>Directory</strong> master with its<br />
replica. To keep the <strong>Open</strong> <strong>Directory</strong> master in operation and make its replica another<br />
master, do not use this procedure. Instead, decommission the replica and then make it<br />
a master as described in “Decommissioning an <strong>Open</strong> <strong>Directory</strong> Replica” on page 193<br />
and “Setting Up an <strong>Open</strong> <strong>Directory</strong> Master” on page 83.<br />
To promote an <strong>Open</strong> <strong>Directory</strong> replica:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the replica server that you want to promote to a<br />
master.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Settings, then click General.<br />
5 Click Change.<br />
This opens the Service Configuration Assistant.<br />
6 Select <strong>Open</strong> <strong>Directory</strong> Master, then click Continue.<br />
7 Enter the following Master Domain Administrator information, then click Continue.<br />
 Name, Short Name, User ID, Password: You must create a user account for the<br />
primary administrator of the LDAP directory. This account is not a copy of the<br />
administrator account in the server’s local directory domain. Make the names and<br />
user ID of the LDAP directory administrator different from the names and user IDs of<br />
user accounts in the local directory domain.<br />
Note: If you plan to connect your <strong>Open</strong> <strong>Directory</strong> master to other directory domains,<br />
pick a unique name and user ID for each domain. Don’t use the suggested diradmin<br />
user ID. Use a name that helps you identify the directory domain that the directory<br />
administrator controls.<br />
8 Enter the following Master Domain information, then click Continue.<br />
 Kerberos Realm: This field is preset to be the same as the server’s DNS name,<br />
converted to capital letters. This is the convention for naming a Kerberos realm. You<br />
can enter a different name if necessary.<br />
 Search Base: This field is preset to a search base suffix for the new LDAP directory,<br />
derived from the domain portion of the server’s DNS name. You can enter a different<br />
search base suffix or leave it blank. If you leave this field blank, the LDAP directory’s<br />
default search base suffix is used.<br />
9 Confirm settings, then click Close.<br />
This saves your setting and restarts the service.<br />
Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services 191
10 In <strong>Server</strong> Admin, connect to another replica of the old master.<br />
11 Click the triangle to the left of the server.<br />
The list of services appears.<br />
12 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
13 Click Settings, then click General.<br />
14 Click Change.<br />
The Service Configuration Assistant opens.<br />
15 Choose Standalone, then click Continue.<br />
16 Confirm the <strong>Open</strong> <strong>Directory</strong> configuration setting, then click Continue.<br />
17 If you are sure that users and services no longer need access to the directory data<br />
stored in the shared directory domain that the server has been hosting or connected<br />
to, click Close.<br />
This saves your setting and restarts the service.<br />
18 Click Change.<br />
The Service Configuration Assistant opens.<br />
19 Choose <strong>Open</strong> <strong>Directory</strong> Replica, then click Continue.<br />
20 Enter the following information:<br />
 “IP address or DNS name of <strong>Open</strong> <strong>Directory</strong> master:” Enter the IP address or DNS<br />
name of the server that is the <strong>Open</strong> <strong>Directory</strong> master.<br />
 “Root password on <strong>Open</strong> <strong>Directory</strong> master:” Enter the password of the <strong>Open</strong><br />
<strong>Directory</strong> master system’s root user (user name system administrator).<br />
 “Domain administrator’s short name:” Enter the name of an LDAP directory domain<br />
administrator account.<br />
 “Domain administrator’s password:” Enter the password of the administrator<br />
account whose name you entered.<br />
21 Click Continue.<br />
22 Confirm the <strong>Open</strong> <strong>Directory</strong> configuration settings, then click Continue.<br />
23 Click Close.<br />
This saves your setting and restarts the service.<br />
24 For each replica of the old master, repeat steps 14–23.<br />
25 Make sure the date, time, and time zone are correct on the replicas and the master.<br />
The replicas and the master should use the same network time service so their clocks<br />
remain in sync.<br />
If other computers were connected to the old <strong>Open</strong> <strong>Directory</strong> master’s LDAP directory,<br />
reconfigure their connections to use the new master’s LDAP directory.<br />
192 Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services
Each <strong>Mac</strong> <strong>OS</strong> X and <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> computer with a custom search policy that<br />
included the old master’s LDAP directory must be reconfigured to connect to the new<br />
master’s LDAP directory. Use the Services and Authentication panes of <strong>Directory</strong> Utility.<br />
For more information, see “Deleting a Configuration for Accessing an LDAP <strong>Directory</strong>”<br />
on page 143, and “Configuring Access to an LDAP <strong>Directory</strong>” on page 136.<br />
If DHCP service provided the old master’s LDAP URL to computers with automatic<br />
search policies, reconfigure DHCP service to provide the new master’s LDAP URL.<br />
<strong>Mac</strong> <strong>OS</strong> X and <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> computers with automatic search policies require no<br />
reconfiguration. They get the correct LDAP URL from the updated DHCP service the<br />
next time they start up.<br />
For more information, see the DHCP chapter of Network Services <strong>Administration</strong>.<br />
Decommissioning an <strong>Open</strong> <strong>Directory</strong> Replica<br />
You can take an <strong>Open</strong> <strong>Directory</strong> replica server out of service by making it a standalone<br />
server or by connecting it to another system for directory and authentication services.<br />
To decommission an <strong>Open</strong> <strong>Directory</strong> replica:<br />
1 Verify that the network connection is working between the <strong>Open</strong> <strong>Directory</strong> master and<br />
the replica you want to decommission.<br />
Port 389 or 636 must be open between master and replica while decommissioning the<br />
replica. LDAP uses port 389 if SSL is disabled or port 636 if SSL is enabled on the<br />
master. (Port 22, used for SSH, does not need to be open to decommission a replica.)<br />
Important: If you decommission a replica while there is no network connectivity<br />
between it and the master, the decommissioned replica remains in the master’s list of<br />
replicas. The master will try to replicate to the decommissioned replica as specified in<br />
the General settings pane for <strong>Open</strong> <strong>Directory</strong> service on the master server.<br />
2 In <strong>Server</strong> Admin, connect to the replica you want to decommission.<br />
3 Click the triangle to the left of the server.<br />
The list of services appears.<br />
4 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
5 Click Settings, then click General.<br />
6 Click Change.<br />
The Service Configuration Assistant opens.<br />
7 Choose Standalone or Connected to a <strong>Directory</strong> System and enter the following<br />
information.<br />
 “Root password on <strong>Open</strong> <strong>Directory</strong> master:” Enter the password of the <strong>Open</strong><br />
<strong>Directory</strong> master system’s root user (user name system administrator).<br />
Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services 193
 “Domain administrator’s short name:” Enter the name of an LDAP directory domain<br />
administrator account.<br />
 “Domain administrator’s password:” Enter the password of the administrator<br />
account whose name you entered.<br />
8 Click Continue.<br />
9 Confirm the <strong>Open</strong> <strong>Directory</strong> configuration setting, then click Continue.<br />
10 If you are sure that users and services no longer need access to the directory data<br />
stored in the shared directory domain that the server has been hosting or connected<br />
to, click Close.<br />
This saves your setting and restarts the service.<br />
Assuming there is a network connection between the <strong>Open</strong> <strong>Directory</strong> master and the<br />
replica, the master is updated to no longer connect to the replica.<br />
11 If you chose “Connected to a <strong>Directory</strong> System” from the Role pop-up menu, click the<br />
<strong>Open</strong> <strong>Directory</strong> Utility button to configure access to one or more directory systems.<br />
For more information about configuring access to a directory service, see Chapter 7,<br />
“Managing <strong>Directory</strong> Clients.”<br />
Archiving an <strong>Open</strong> <strong>Directory</strong> Master<br />
You can use <strong>Server</strong> Admin to archive a copy of an <strong>Open</strong> <strong>Directory</strong> master’s directory<br />
and authentication data. You can archive a copy of the data while the <strong>Open</strong> <strong>Directory</strong><br />
master is in service.<br />
The following files are archived:<br />
 LDAP directory database and configuration files<br />
 <strong>Open</strong> <strong>Directory</strong> password server database<br />
 Kerberos database and configuration files<br />
 Local directory domain and shadow password database<br />
If you have a reliable archive of an <strong>Open</strong> <strong>Directory</strong> master, you effectively have an<br />
archive of all its replicas. If a replica develops a problem, you can change its <strong>Open</strong><br />
<strong>Directory</strong> role to standalone server and then set up the server as if it were a new server,<br />
with a new host name, and set it up as a replica of the same master as before.<br />
Important: Carefully safeguard the archive media that contains a copy of the <strong>Open</strong><br />
<strong>Directory</strong> password database, the Kerberos database, and the Kerberos keytab file. The<br />
archive contains passwords of all users who have an <strong>Open</strong> <strong>Directory</strong> password, both in<br />
the shared LDAP directory domain and in the local directory domain. Your security<br />
precautions for the archive media should be as stringent as for the <strong>Open</strong> <strong>Directory</strong><br />
master server.<br />
194 Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services
To archive an <strong>Open</strong> <strong>Directory</strong> master:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to <strong>Open</strong> <strong>Directory</strong> master server.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Archive.<br />
5 In the Archive in field, enter the path to the folder where you want the <strong>Open</strong> <strong>Directory</strong><br />
data archived, then click the Archive button.<br />
You can type the folder path or click Choose to select it.<br />
6 Enter a name and password to use in encrypting the archive, then click OK.<br />
Restoring an <strong>Open</strong> <strong>Directory</strong> Master<br />
You can use <strong>Server</strong> Admin or the slapconfig command-line tool to restore an <strong>Open</strong><br />
<strong>Directory</strong> master’s directory and authentication data from an archive.<br />
If you use <strong>Server</strong> Admin, you can restore to a server that is an <strong>Open</strong> <strong>Directory</strong> master.<br />
The following files are restored by merging the archive with the existing master:<br />
 LDAP directory database and configuration files<br />
 <strong>Open</strong> <strong>Directory</strong> password server database<br />
 Kerberos database and configuration files<br />
If conflicts are encountered during the merge operation, the existing record takes<br />
precedence over the one in the archive. The archive record is ignored. Conflicts are<br />
recorded in the slapconfig log file (/Library/Logs/slapconfig.log), which you can view<br />
using <strong>Server</strong> Admin. See “Viewing <strong>Open</strong> <strong>Directory</strong> Status and Logs” on page 178.<br />
Important: If you have an archive of a <strong>Mac</strong> <strong>OS</strong> X v10.4 <strong>Open</strong> <strong>Directory</strong> server you can<br />
only restore it to a <strong>Mac</strong> <strong>OS</strong> X <strong>v10.5</strong> server. You cannot merge a <strong>Mac</strong> <strong>OS</strong> X v10.4 archive<br />
into a <strong>Mac</strong> <strong>OS</strong> X <strong>v10.5</strong> <strong>Open</strong> <strong>Directory</strong> server.<br />
Instead of restoring an <strong>Open</strong> <strong>Directory</strong> master from an archive, you may get better<br />
results by promoting a replica to be the master. The replica may have more recent<br />
directory and authentication data than the archive.<br />
After restoring an <strong>Open</strong> <strong>Directory</strong> master from an archive, you must recreate your <strong>Open</strong><br />
<strong>Directory</strong> replicas.<br />
Important: Restoring an archive shouldn’t be used as a means of porting directory and<br />
authentication data from one system to another. Instead, export from the source<br />
directory and import to the target directory. For more information about exporting and<br />
importing directory data, see User Management.<br />
Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services 195
To merge an archive with an existing <strong>Open</strong> <strong>Directory</strong> master:<br />
1 <strong>Open</strong> <strong>Server</strong> Admin and connect to the <strong>Open</strong> <strong>Directory</strong> master server.<br />
The target server must have the same Kerberos realm name as the master that the<br />
archive was created from.<br />
2 Click the triangle to the left of the server.<br />
The list of services appears.<br />
3 From the expanded <strong>Server</strong>s list, select <strong>Open</strong> <strong>Directory</strong>.<br />
4 Click Archive.<br />
5 In the Restore from field, enter the path to the <strong>Open</strong> <strong>Directory</strong> archive file, then click<br />
the Restore button.<br />
You can type the path or click Choose to select the archive file.<br />
6 Enter the password that was used to encrypt the archive when it was created, then<br />
click OK.<br />
7 When the restore operation finishes, check the slapconfig log for information about<br />
conflicts or other events that occurred while restoring.<br />
8 Convert existing <strong>Open</strong> <strong>Directory</strong> replica servers to <strong>Open</strong> <strong>Directory</strong> standalone servers<br />
and then make them replicas of the new master.<br />
For more information, see “Setting Up a Standalone <strong>Directory</strong> Service” on page 81 and<br />
“Setting Up an <strong>Open</strong> <strong>Directory</strong> Replica” on page 88.<br />
From the Command Line<br />
Instead of restoring to a server that is an <strong>Open</strong> <strong>Directory</strong> master, you can restore to a<br />
standalone server by using the slapconfig command-line tool. The server becomes an<br />
<strong>Open</strong> <strong>Directory</strong> master with directory and authentication data from the archive.<br />
The restored data includes the LDAP, Kerberos, and password server files listed above<br />
plus the local directory domain and associated shadow password files.<br />
In addition, slapconfig preserves the local user account you used in the login window.<br />
After restoring, the master contains the user account records from the archive plus the<br />
account you used in the login window.<br />
If the archive contains a user account that conflicts with the account you used in the<br />
login window, the account from the archive is ignored.<br />
WARNING: If you restore a standalone server, the preexisting directory records and<br />
authentication data are not retained, except for the user account you used in the<br />
login window.<br />
196 Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services
To replace the directory and authentication data on a standalone server with data from<br />
an <strong>Open</strong> <strong>Directory</strong> archive, enter the following command in Terminal, replacing<br />
archive-path with the path to the archive file:<br />
$ sudo slapconfig -restoredb archive-path<br />
The slapconfig command requires root privileges, hence the use of sudo in this<br />
command line. For more information about slapconfig, see its man page. For more<br />
information about sudo and root privileges, see Command-Line <strong>Administration</strong>.<br />
Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services 197
198 Chapter 9 Maintaining <strong>Open</strong> <strong>Directory</strong> Services
10 Solving<br />
<strong>Open</strong> <strong>Directory</strong> Problems<br />
10<br />
This chapter provides solutions for common problems you<br />
might encounter while working with <strong>Open</strong> <strong>Directory</strong>.<br />
This section contains solutions to common <strong>Open</strong> <strong>Directory</strong> problems.<br />
Solving <strong>Open</strong> <strong>Directory</strong> Master and Replica Problems<br />
Use the following to help solve <strong>Open</strong> <strong>Directory</strong> master and replica problems.<br />
If Kerberos Is Stopped on an <strong>Open</strong> <strong>Directory</strong> Master or Replica<br />
An <strong>Open</strong> <strong>Directory</strong> master requires properly configured DNS so it can provide single<br />
sign-on Kerberos authentication.<br />
To confirm that DNS is configured correctly for Kerberos:<br />
1 Make sure DNS service is configured to resolve fully qualified DNS names and provide<br />
corresponding reverse lookups.<br />
DNS must resolve fully qualified DNS names and provide reverse lookups for the <strong>Open</strong><br />
<strong>Directory</strong> master server, replica servers, and other servers that are members of the<br />
Kerberos realm.<br />
To perform a DNS lookup of a server’s DNS name and a reverse lookup of the server’s IP<br />
address, you can use the Lookup pane of Network Utility (in /Applications/Utilities/).<br />
For more information about setting up DNS service, see Network Services <strong>Administration</strong>.<br />
2 Make sure the <strong>Open</strong> <strong>Directory</strong> master server’s host name is the correct fully qualified<br />
DNS name, not the server’s local hostname.<br />
For example, the host name might be ods.example.com but should not be ods.local.<br />
You can see the host name by opening Terminal and entering hostname.<br />
If the <strong>Open</strong> <strong>Directory</strong> server’s host name isn’t its fully qualified DNS name, temporarily<br />
clear the list of DNS servers and click Apply in the <strong>Open</strong> <strong>Directory</strong> server’s Network<br />
preferences. Then re-enter one or more DNS server IP addresses, starting with the<br />
primary DNS server that resolves the <strong>Open</strong> <strong>Directory</strong> server’s name, and clicking Apply<br />
in Network Preferences.<br />
199
If the <strong>Open</strong> <strong>Directory</strong> server’s host name still isn’t its fully qualified DNS name, restart<br />
the server.<br />
3 Make sure the <strong>Open</strong> <strong>Directory</strong> master server’s Network preferences are configured to<br />
use the DNS server that resolves the server’s name.<br />
If the <strong>Open</strong> <strong>Directory</strong> master server provides its own DNS service, the server’s Network<br />
preferences must be configured to use itself as a DNS server.<br />
4 After confirming the correct DNS configuration for the server, start Kerberos.<br />
See “Starting Kerberos After Setting Up an <strong>Open</strong> <strong>Directory</strong> Master” on page 99.<br />
If You Can’t Create an <strong>Open</strong> <strong>Directory</strong> Replica<br />
If you try to create two replicas simultaneously, one attempt will succeed and the other<br />
will fail. A subsequent attempt to establish the second replica should succeed. If you<br />
still can’t create the second replica, go to folder /var/run/, look for the file<br />
slapconfig.lock, and remove it if it exists. Alternatively, restart the server.<br />
If You Can’t Create an <strong>Open</strong> <strong>Directory</strong> Master or Replica from a<br />
Configuration File<br />
You can’t make <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> an <strong>Open</strong> <strong>Directory</strong> master or <strong>Open</strong> <strong>Directory</strong> replica by<br />
dragging a property-list configuration file to the <strong>Open</strong> <strong>Directory</strong> Settings pane in<br />
<strong>Server</strong> Admin. Instead, follow the instructions in “Setting Up an <strong>Open</strong> <strong>Directory</strong> Master”<br />
on page 83 or “Setting Up an <strong>Open</strong> <strong>Directory</strong> Replica” on page 88.<br />
You create a property-list configuration file is by dragging the miniature window from<br />
the lower right corner of the Settings pane in <strong>Server</strong> Admin.<br />
If You Can’t Connect a Replica to Your Relay<br />
Make sure your replica has not reached its capacity of 32 replicas. Also make sure that<br />
you are not connecting to a second tier replica instead of a first tier relay.<br />
If You Can’t Join an <strong>Open</strong> <strong>Directory</strong> Replica to an <strong>Open</strong> <strong>Directory</strong> that<br />
is a Subordinate of an Active <strong>Directory</strong> <strong>Server</strong><br />
Before you try to turn the server into a replica of the subordinate OD server make sure<br />
that you first connect the server to the same Active <strong>Directory</strong> server as the OD master<br />
server you are attempting to connect to. Your replicas must have access to the Active<br />
<strong>Directory</strong> server for Kerberos to work.<br />
200 Chapter 10 Solving <strong>Open</strong> <strong>Directory</strong> Problems
Solving <strong>Directory</strong> Connection Problems<br />
Problems accessing directory services during startup can have several causes.<br />
If a Delay Occurs During Startup<br />
If <strong>Mac</strong> <strong>OS</strong> X or <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> experience a startup delay while a message about<br />
LDAP or directory services appears above the progress bar, the computer could be<br />
trying to access an LDAP directory that is not available on your network. Consider the<br />
following:<br />
 A pause during startup is normal if a portable computer is not connected to the<br />
network that the LDAP server is connected to.<br />
 Use <strong>Directory</strong> Utility to make sure the local directory domain and LDAP<br />
configurations are correct.<br />
 Use the Network pane of System Preferences to make sure the computer’s network<br />
location and other network settings are correct.<br />
 Inspect the physical network connection for faults.<br />
Solving Authentication Problems<br />
Use the following to help resolve authentication problems.<br />
If You Can’t Change a User’s <strong>Open</strong> <strong>Directory</strong> Password<br />
To change the password of a user whose password type is <strong>Open</strong> <strong>Directory</strong>, you must be<br />
an administrator of the directory domain where the user’s record resides. In addition,<br />
your user account must have a password type of <strong>Open</strong> <strong>Directory</strong>.<br />
The user account specified when the <strong>Open</strong> <strong>Directory</strong> master was set up (using <strong>Server</strong><br />
Assistant or the <strong>Open</strong> <strong>Directory</strong> service settings in <strong>Server</strong> Admin) normally has an <strong>Open</strong><br />
<strong>Directory</strong> password. You can use this account to set up other user accounts as directory<br />
domain administrators with <strong>Open</strong> <strong>Directory</strong> passwords.<br />
If all else fails, use the root user account to set up a user account as a directory<br />
administrator with an <strong>Open</strong> <strong>Directory</strong> password. (The root user account’s name is “root”<br />
and the password is usually the same as the password given to the administrator<br />
account created during server setup.)<br />
If a User Can’t Access Some Services<br />
If a user can access some services that require authentication but not others,<br />
temporarily change the user’s password to a simple sequence of characters, such as<br />
“password.”<br />
If this solves the problem, the user’s previous password contained characters that were<br />
not recognized by all services. For example, some services accept spaces in passwords<br />
while others don’t.<br />
Chapter 10 Solving <strong>Open</strong> <strong>Directory</strong> Problems 201
If a User Can’t Authenticate for VPN Service<br />
Users whose accounts are stored on a server with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.2 can’t<br />
authenticate to VPN service provided by <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.3–10.5. VPN service<br />
requires the MS-CHAPv2 authentication method, which isn’t supported in <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> v10.2.<br />
To enable affected users to log in, move their user accounts to a server with <strong>Mac</strong> <strong>OS</strong> X<br />
<strong>Server</strong> v10.3–10.5. Alternatively, upgrade the older server to <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> <strong>v10.5</strong> or<br />
later.<br />
If You Can’t Change a User’s Password Type to <strong>Open</strong> <strong>Directory</strong><br />
To change a user’s password type to <strong>Open</strong> <strong>Directory</strong> authentication, you must be an<br />
administrator of the directory domain where the user’s record resides. In addition, your<br />
user account must be configured for <strong>Open</strong> <strong>Directory</strong> authentication.<br />
The user account specified when the <strong>Open</strong> <strong>Directory</strong> master was set up (using <strong>Server</strong><br />
Assistant or the <strong>Open</strong> <strong>Directory</strong> service settings in <strong>Server</strong> Admin) has an <strong>Open</strong><br />
<strong>Directory</strong> password. You can use this account to set up other user accounts as directory<br />
domain administrators with <strong>Open</strong> <strong>Directory</strong> passwords.<br />
If Users Relying on a Password <strong>Server</strong> Can’t Log In<br />
If your network has a server with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> v10.2, it could be configured to get<br />
authentication from an <strong>Open</strong> <strong>Directory</strong> password server hosted by another server.<br />
If the password server’s computer becomes disconnected from your network, for<br />
example because you unplug the cable from the computer’s Ethernet port, users<br />
whose passwords are validated using the password server can’t log in because the IP<br />
address isn’t accessible.<br />
Users can log in to <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> if you reconnect the password server’s computer to<br />
the network. Alternatively, while the password server’s computer is offline, users can<br />
log in with user accounts whose password type is crypt password or shadow password.<br />
If Users Can’t Log In with Accounts in a Shared <strong>Directory</strong> Domain<br />
Users can’t log in using accounts in a shared directory domain if the server hosting the<br />
directory isn’t accessible. A server can become inaccessible due to a problem with the<br />
network, the server software, or the server hardware.<br />
Problems with the server hardware or software affect users trying to log in to <strong>Mac</strong> <strong>OS</strong> X<br />
computers and users trying to log in to the Windows domain of a <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
PDC. Network problems can affect some users but not others, depending on where the<br />
network problem is.<br />
202 Chapter 10 Solving <strong>Open</strong> <strong>Directory</strong> Problems
Users with mobile user accounts can still log in to <strong>Mac</strong> <strong>OS</strong> X computers they used<br />
previously, and users affected by these problems can log in by using a local user<br />
account defined on the computer, such as the user account created during setup after<br />
installing <strong>Mac</strong> <strong>OS</strong> X.<br />
If You Can’t Log In as an Active <strong>Directory</strong> User<br />
After configuring a connection to an Active <strong>Directory</strong> domain in the Service pane of<br />
<strong>Directory</strong> Utility and adding it to a custom search policy in the Authentication pane,<br />
wait 10 or 15 seconds for the change to take effect. Attempts to log in immediately<br />
with an Active <strong>Directory</strong> account will be unsuccessful.<br />
If Users Can’t Authenticate Using Single Sign-On Kerberos<br />
When a user or service that uses Kerberos experiences authentication failures, try these<br />
remedies:<br />
 Kerberos authentication is based on encrypted time stamps. If there’s more than a 5-<br />
minute difference between the KDC, client, and service computers, authentication<br />
may fail. Make sure the clocks for all computers are synchronized using the Network<br />
Time Protocol (NTP) service of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> or another network time server. For<br />
information about the NTP service of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>, see Network Services<br />
<strong>Administration</strong>.<br />
 Make sure Kerberos is running on the <strong>Open</strong> <strong>Directory</strong> master and replicas. See “If<br />
Kerberos Is Stopped on an <strong>Open</strong> <strong>Directory</strong> Master or Replica” on page 199.<br />
 If a Kerberos server used for password validation is not available, reset the user’s<br />
password to use a server that is available.<br />
 Make sure the server providing the Kerberized service has access to the Kerberos<br />
server’s directory domain, and make sure this directory domain contains the<br />
accounts for users who are trying to authenticate using Kerberos. For information<br />
about configuring access to directory domains, see Chapter 7, “Managing <strong>Directory</strong><br />
Clients.”<br />
 For an <strong>Open</strong> <strong>Directory</strong> server’s Kerberos realm, make sure the client computer is<br />
configured to access the <strong>Open</strong> <strong>Directory</strong> server’s LDAP directory using the correct<br />
search base suffix. The client’s LDAPv3 search base suffix setting must match the<br />
LDAP directory’s search base setting. The client’s LDAPv3 search base suffix can be<br />
blank if it gets its LDAP mappings from the server. If so, the client uses the LDAP<br />
directory’s default search base suffix.<br />
 To check the client’s search base suffix setting, open <strong>Directory</strong> Utility, show the list<br />
of LDAPv3 configurations, and choose the item from the LDAP Mappings pop-up<br />
menu that’s already selected in the menu. For more information, see “Changing a<br />
Configuration for Accessing an LDAP <strong>Directory</strong>” on page 140.<br />
 To check the LDAP directory’s search base setting, open <strong>Server</strong> Admin and look in<br />
the Protocols pane of the Settings pane for <strong>Open</strong> <strong>Directory</strong> service.<br />
Chapter 10 Solving <strong>Open</strong> <strong>Directory</strong> Problems 203
 For information that can help you solve problems, see the KDC log. See “Viewing<br />
<strong>Open</strong> <strong>Directory</strong> Status and Logs” on page 178.<br />
 If Kerberos was not running when user records were created, imported, or updated<br />
from an earlier <strong>Mac</strong> <strong>OS</strong> X version, they may not be enabled for Kerberos<br />
authentication:<br />
 A record isn’t enabled for Kerberos if its authentication authority attribute lacks the<br />
;Kerberosv5; value. Use the Inspector in Workgroup Manager to see the values of a<br />
user record’s authentication authority attribute. For more information, see<br />
“Showing the <strong>Directory</strong> Inspector” on page 179.<br />
 Enable Kerberos for a user record by changing its password type. First set the<br />
password type to Crypt Password, then set it to <strong>Open</strong> <strong>Directory</strong>. For more<br />
information, see “Changing the Password Type to Crypt Password” on page 110 and<br />
“Changing the Password Type to <strong>Open</strong> <strong>Directory</strong>” on page 108.<br />
 If users can’t authenticate using single sign-on or Kerberos for services provided by a<br />
server that is joined to an <strong>Open</strong> <strong>Directory</strong> master’s Kerberos realm, the server’s<br />
computer record might be incorrectly configured in the <strong>Open</strong> <strong>Directory</strong> master’s<br />
LDAP directory. The server’s name in the computer group account must be the<br />
server’s fully qualified DNS name, not just the server’s host name. For example, the<br />
name could be server2.example.com but not just server2.<br />
To reconfigure a server’s computer record for single sign-on Kerberos<br />
authentication:<br />
1 Delete the server from the computer group account in the LDAP directory.<br />
For more information about this and the next step, see User Management.<br />
2 Add the server to the computer group again.<br />
3 Delegate authority again for joining the server to the <strong>Open</strong> <strong>Directory</strong> master’s Kerberos<br />
realm.<br />
For more information, see “Delegating Authority to Join an <strong>Open</strong> <strong>Directory</strong> Kerberos<br />
Realm” on page 100.<br />
4 Rejoin the server to the <strong>Open</strong> <strong>Directory</strong> Kerberos realm.<br />
For more information, see “Joining a <strong>Server</strong> to a Kerberos Realm” on page 102.<br />
204 Chapter 10 Solving <strong>Open</strong> <strong>Directory</strong> Problems
If Users Can’t Change Their Passwords<br />
Users whose accounts reside in an LDAP directory not hosted by <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> and<br />
who have a password type of crypt password cannot change their passwords after<br />
logging in from a client computer with <strong>Mac</strong> <strong>OS</strong> X version 10.3.<br />
These users can change their passwords if you use Workgroup Manager’s Advanced<br />
pane to change their accounts’ User Password Type setting to <strong>Open</strong> <strong>Directory</strong>.<br />
When you make this change, you must also enter a new password. Then instruct users<br />
to log in using this new password and change it in the Accounts pane of System<br />
Preferences.<br />
If You Can’t Join a <strong>Server</strong> to an <strong>Open</strong> <strong>Directory</strong> Kerberos Realm<br />
If a user with delegated Kerberos authority can’t join a server to an <strong>Open</strong> <strong>Directory</strong><br />
master’s Kerberos realm, the server’s computer record may be incorrectly configured in<br />
the <strong>Open</strong> <strong>Directory</strong> master’s LDAP directory.<br />
The server’s address in the computer group account must be the server’s primary<br />
Ethernet address. The primary Ethernet address is the Ethernet ID of the first Ethernet<br />
port in the list of network port configurations shown in the server’s Network<br />
preferences pane.<br />
To reconfigure a server’s computer record for joining a Kerberos realm:<br />
1 Delete the server from the computer group account in the LDAP directory.<br />
For more information about this and the next step, see User Management.<br />
2 Add the server to the computer group again.<br />
3 Delegate authority again for joining the server to the <strong>Open</strong> <strong>Directory</strong> master’s Kerberos<br />
realm.<br />
Skip this step if you can use a Kerberos administrator account (LDAP directory<br />
administrator account) to rejoin the server to the Kerberos realm.<br />
For more information, see “Delegating Authority to Join an <strong>Open</strong> <strong>Directory</strong> Kerberos<br />
Realm” on page 100.<br />
4 Rejoin the server to the <strong>Open</strong> <strong>Directory</strong> Kerberos realm.<br />
For more information, see “Joining a <strong>Server</strong> to a Kerberos Realm” on page 102.<br />
Chapter 10 Solving <strong>Open</strong> <strong>Directory</strong> Problems 205
If You Must Reset an Administrator Password<br />
Using the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> installation disc, you can change the password of a user<br />
account that has administrator privileges, including the system administrator (root or<br />
superuser) account.<br />
Important: Because a user with the installation disc can gain unrestricted access to<br />
your server, restrict physical access to the server hardware.<br />
To reset an administrator password:<br />
1 Start up from the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> Install Disc 1.<br />
2 When the Installer appears, choose Installer > Reset Password.<br />
3 Select the hard disk volume that contains the administrator account whose password<br />
you want to reset.<br />
4 From the pop-up menu, enter a new password, choose the administrator account, and<br />
click Save.<br />
The system administrator account is the root user (superuser) account. Don’t confuse<br />
this account with a normal administrator account.<br />
Avoid changing the password of predefined user accounts. For more information about<br />
predefined user accounts, see User Management.<br />
Note: This procedure changes the password of the administrator account in the<br />
server’s local directory domain. It does not change the password of an administrator<br />
account in the server’s shared directory domain, if the server has one.<br />
If you know the password of an administrator account in the local domain, you can<br />
change the password of any other administrator account in the local directory domain<br />
by using Workgroup Manager instead of this procedure. For more information, see<br />
“Changing a User’s Password” on page 106.<br />
206 Chapter 10 Solving <strong>Open</strong> <strong>Directory</strong> Problems
<strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data<br />
Appendix<br />
Knowing the <strong>Open</strong> <strong>Directory</strong> LDAP schema and the record<br />
types and attributes in <strong>Mac</strong> <strong>OS</strong> X directory domains can help<br />
you map to other directory domains and import or export<br />
user and group accounts.<br />
This appendix lists <strong>Open</strong> <strong>Directory</strong> extensions to LDAP schema, mappings of <strong>Open</strong><br />
<strong>Directory</strong> attributes to LDAP and Active <strong>Directory</strong> attributes, and the standard<br />
attributes in various types of records. Use this information for:<br />
 Mapping object classes and attributes of non-<strong>Apple</strong> LDAP directories or Active<br />
<strong>Directory</strong> domains to <strong>Open</strong> <strong>Directory</strong> record types and attributes, as described in<br />
“Configuring LDAP Searches and Mappings” on page 146.<br />
 Importing or exporting user or group accounts to an <strong>Open</strong> <strong>Directory</strong> domain, as<br />
described in User Management.<br />
 Working in Workgroup Manager’s Inspector pane, as described in “Viewing and<br />
Editing <strong>Directory</strong> Data” on page 179.<br />
Note: The following tables do not provide complete information for extending your<br />
schema. The table indicates the records and attributes that <strong>Open</strong> <strong>Directory</strong> uses from<br />
existing Active <strong>Directory</strong> and Unix RFC2307 schemas. It also indicates the attributes and<br />
records that do not have a direct mapping.<br />
For details, see:<br />
 “<strong>Open</strong> <strong>Directory</strong> Extensions to LDAP Schema” on page 208<br />
 “Object Classes in <strong>Open</strong> <strong>Directory</strong> LDAP Schema” on page 209<br />
 “Attributes in <strong>Open</strong> <strong>Directory</strong> LDAP Schema” on page 217<br />
 “Mapping Standard Record Types and Attributes to LDAP and Active <strong>Directory</strong>” on<br />
page 237<br />
 “Mappings for Users” on page 238<br />
 “Mappings for Groups” on page 241<br />
 “Mappings for Mounts” on page 242<br />
 “Mappings for Computers” on page 243<br />
207
 “Mappings for ComputerLists” on page 244<br />
 “Mappings for Config” on page 245<br />
 “Mappings for People” on page 246<br />
 “Mappings for PresetComputerLists” on page 248<br />
 “Mappings for PresetGroups” on page 248<br />
 “Mappings for PresetUsers” on page 249<br />
 “Mappings for Printers” on page 251<br />
 “Mappings for Auto<strong>Server</strong>Setup” on page 252<br />
 “Mappings for Locations” on page 253<br />
 “Standard <strong>Open</strong> <strong>Directory</strong> Record Types and Attributes” on page 253<br />
 “Standard Attributes in User Records” on page 253<br />
 “Standard Attributes in Group Records” on page 258<br />
 “Standard Attributes in Computer Records” on page 259<br />
 “Standard Attributes in Computer Group Records” on page 260<br />
 “Standard Attributes in Mount Records” on page 261<br />
 “Standard Attributes in Config Records” on page 262<br />
<strong>Open</strong> <strong>Directory</strong> Extensions to LDAP Schema<br />
The schema for the <strong>Open</strong> <strong>Directory</strong> LDAP directories is based on the de facto standard<br />
attributes and object classes defined in the following Request for Comments<br />
documents of the Internet Engineering Task Force (RFCs of the IETF):<br />
 RFC 2307 “An Approach for Using LDAP as a Network Information Service”<br />
 RFC 2798 “Definition of the inetOrgPerson LDAP Object Class”<br />
LDAP schema definitions specify syntax identifiers and matching rules that are defined<br />
in RFC 2252, “LDAPv3 Attributes.”<br />
These RFCs are available at the IETF website: www.ietf.org/rfc.html.<br />
The attributes and object classes defined in these RFCs form the basis of the <strong>Open</strong><br />
<strong>Directory</strong> LDAP schema.<br />
The extended schema for <strong>Open</strong> <strong>Directory</strong> LDAP directories includes the attributes and<br />
object classes defined in:<br />
 “Object Classes in <strong>Open</strong> <strong>Directory</strong> LDAP Schema” on page 209<br />
 “Attributes in <strong>Open</strong> <strong>Directory</strong> LDAP Schema” on page 217<br />
208 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
Note: <strong>Apple</strong> may extend the <strong>Open</strong> <strong>Directory</strong> LDAP schema in the future; for example,<br />
to support new versions of <strong>Mac</strong> <strong>OS</strong> X and <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>. The latest schema is<br />
available in text files on a computer with <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> installed. The schema files<br />
are in the /etc/openldap/schema/ directory. The apple.schema file contains the latest<br />
schema extensions for <strong>Open</strong> <strong>Directory</strong> LDAP directories.<br />
Object Classes in <strong>Open</strong> <strong>Directory</strong> LDAP Schema<br />
This section defines the <strong>Open</strong> <strong>Directory</strong> LDAP object classes that extend the standard<br />
LDAP schema.<br />
Container Structural Object Class<br />
Container is a structural object class used for top-level record containers such as<br />
cn=users, cn=groups, and cn=mounts. There is no directory services analog to this<br />
object class, but the container name is part of the search base for each record type.<br />
#objectclass (<br />
# 1.2.840.113556.1.3.23<br />
# NAME 'container'<br />
# SUP top<br />
# STRUCTURAL<br />
# MUST ( cn ) )<br />
Time to Live Object Class<br />
objectclass (<br />
1.3.6.1.4.1.250.3.18<br />
NAME 'cacheObject'<br />
AUXILIARY<br />
SUP top<br />
DESC 'Auxiliary object class to hold TTL caching information'<br />
MAY ( ttl ) )<br />
User Object Class<br />
The apple-user object class is an auxiliary class used to store <strong>Mac</strong> <strong>OS</strong> X attributes that<br />
are not part of inetOrgPerson or posixAccount. This object class is used with<br />
kDSStdRecordTypeUsers records.<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.1<br />
NAME 'apple-user'<br />
SUP top<br />
AUXILIARY<br />
DESC 'apple user account'<br />
MAY ( apple-user-homeurl $ apple-user-class $<br />
apple-user-homequota $ apple-user-mailattribute $<br />
apple-user-printattribute $ apple-mcxflags $<br />
apple-mcxsettings $ apple-user-adminlimits $<br />
apple-user-picture $ apple-user-authenticationhint $<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 209
apple-user-homesoftquota $ apple-user-passwordpolicy $<br />
apple-keyword $ apple-generateduid $ apple-imhandle $<br />
apple-webloguri $ authAuthority $ acctFlags $ pwdLastSet $<br />
logonTime $ logoffTime $ kickoffTime $ homeDrive $ scriptPath $<br />
profilePath $ userWorkstations $ smbHome $ rid $<br />
primaryGroupID $ sambaSID $ sambaPrimaryGroupSID $<br />
userCertificate $ jpegPhoto $ apple-nickname $<br />
apple-namesuffix $ apple-birthday $ apple-relationships $<br />
apple-organizationinfo $ apple-phonecontacts $<br />
apple-emailcontacts $ apple-postaladdresses $<br />
apple-mapcoordinates $ apple-mapuri $ apple-mapguid $<br />
apple-serviceslocator) )<br />
Group Auxiliary Object Class<br />
The apple-group object class is an auxiliary class used to store <strong>Mac</strong> <strong>OS</strong> X attributes that<br />
are not part of posixGroup. This object class is used with kDSStdRecordTypeGroups<br />
records.<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.14<br />
NAME 'apple-group'<br />
SUP top<br />
AUXILIARY<br />
DESC 'group account'<br />
MAY ( apple-group-homeurl $<br />
apple-group-homeowner $<br />
apple-mcxflags $<br />
apple-mcxsettings $<br />
apple-group-realname $<br />
apple-user-picture $<br />
apple-keyword $<br />
apple-generateduid $<br />
apple-group-nestedgroup $<br />
apple-group-memberguid $<br />
mail $<br />
rid $<br />
sambaSID $<br />
ttl $<br />
jpegPhoto $<br />
apple-group-services $<br />
apple-contactguid $<br />
apple-ownerguid $<br />
labeledURI $<br />
apple-serviceslocator) )<br />
<strong>Mac</strong>hine Auxiliary Object Class<br />
objectclass (<br />
210 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
1.3.6.1.4.1.63.1000.1.1.2.3<br />
NAME 'apple-machine'<br />
SUP top<br />
AUXILIARY<br />
MAY ( apple-machine-software $<br />
apple-machine-hardware $<br />
apple-machine-serves $<br />
apple-machine-suffix $<br />
apple-machine-contactperson ) )<br />
Mount Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.8<br />
NAME 'mount'<br />
SUP top STRUCTURAL<br />
MUST ( cn )<br />
MAY ( mount<strong>Directory</strong> $<br />
mountType $<br />
mountOption $<br />
mountDumpFrequency $<br />
mountPassNo ) )<br />
Printer Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.9<br />
NAME 'apple-printer'<br />
SUP top STRUCTURAL<br />
MUST ( cn )<br />
MAY ( apple-printer-attributes $<br />
apple-printer-lprhost $<br />
apple-printer-lprqueue $<br />
apple-printer-type $<br />
apple-printer-note ) )<br />
Computer Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.10<br />
NAME 'apple-computer'<br />
DESC 'computer'<br />
SUP top STRUCTURAL<br />
MUST ( cn )<br />
MAY ( apple-realname $<br />
description $<br />
macAddress $<br />
apple-category $<br />
apple-computer-list-groups $<br />
apple-keyword $<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 211
apple-mcxflags $<br />
apple-mcxsettings $<br />
apple-networkview $<br />
apple-xmlplist $<br />
apple-service-url $<br />
apple-serviceinfo $<br />
apple-primarycomputerlist $<br />
authAuthority $<br />
uidNumber $ gidNumber $ apple-generateduid $ ttl $<br />
acctFlags $ pwdLastSet $ logonTime $<br />
logoffTime $ kickoffTime $ rid $ primaryGroupID $<br />
sambaSID $ sambaPrimaryGroupSID<br />
owner $ apple-ownerguid $ apple-contactguid $<br />
ipHostNumber $ bootFile) )<br />
ComputerList Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.11<br />
NAME 'apple-computer-list'<br />
DESC 'computer list'<br />
SUP top STRUCTURAL<br />
MUST ( cn )<br />
MAY ( apple-mcxflags $<br />
apple-mcxsettings $<br />
apple-computer-list-groups $<br />
apple-computers $<br />
apple-generateduid $<br />
apple-keyword ) )<br />
Configuration Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.12<br />
NAME 'apple-configuration'<br />
DESC 'configuration'<br />
SUP top STRUCTURAL<br />
MAY ( cn $ apple-config-realname $<br />
apple-data-stamp $ apple-password-server-location $<br />
apple-password-server-list $ apple-ldap-replica $<br />
apple-ldap-writable-replica $ apple-keyword $<br />
apple-kdc-authkey $ apple-kdc-configdata $ apple-xmlplist $<br />
ttl ) )<br />
Preset Computer List Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.13<br />
NAME 'apple-preset-computer-list'<br />
DESC 'preset computer list'<br />
212 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
SUP top STRUCTURAL<br />
MUST ( cn )<br />
MAY ( apple-mcxflags $<br />
apple-mcxsettings $<br />
apple-computer-list-groups $<br />
apple-keyword ) )<br />
Preset Computer Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.25<br />
NAME 'apple-preset-computer'<br />
DESC 'preset computer'<br />
SUP top STRUCTURAL<br />
MUST ( cn )<br />
MAY ( apple-mcxflags $<br />
apple-mcxsettings $<br />
apple-computer-list-groups $<br />
apple-primarycomputerlist $<br />
description $<br />
apple-networkview $<br />
apple-keyword ) )<br />
Preset Computer Group Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.26<br />
NAME 'apple-preset-computer-group'<br />
DESC 'preset computer group'<br />
SUP top STRUCTURAL<br />
MUST ( cn )<br />
MAY ( gidNumber $<br />
memberUID $<br />
apple-mcxflags $<br />
apple-mcxsettings $<br />
apple-group-nestedgroup $<br />
description $<br />
jpegPhoto $<br />
apple-keyword ) )<br />
Preset Group Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.3.14<br />
NAME 'apple-preset-group'<br />
DESC 'preset group'<br />
SUP top STRUCTURAL<br />
MUST ( cn )<br />
MAY ( memberUid $<br />
gidNumber $<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 213
description $<br />
apple-group-homeurl $<br />
apple-group-homeowner $<br />
apple-mcxflags $<br />
apple-mcxsettings $<br />
apple-group-realname $<br />
apple-keyword $<br />
apple-group-nestedgroup $<br />
apple-group-memberguid $<br />
ttl $<br />
jpegPhoto $<br />
apple-group-services $<br />
labeledURI) )) )<br />
Preset User Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.15<br />
NAME 'apple-preset-user'<br />
DESC 'preset user'<br />
SUP top STRUCTURAL<br />
MUST ( cn )<br />
MAY ( uid $<br />
memberUid $<br />
gidNumber $<br />
home<strong>Directory</strong> $<br />
apple-user-homeurl $<br />
apple-user-homequota $<br />
apple-user-homesoftquota $<br />
apple-user-mailattribute $<br />
apple-user-printattribute $<br />
apple-mcxflags $<br />
apple-mcxsettings $<br />
apple-user-adminlimits $<br />
apple-user-passwordpolicy $<br />
userPassword $<br />
apple-user-picture $<br />
apple-keyword $<br />
loginShell $<br />
description $<br />
shadowLastChange $<br />
shadowExpire $<br />
authAuthority $<br />
homeDrive $ scriptPath $ profilePath $ smbHome $<br />
apple-preset-user-is-admin<br />
jpegPhoto $<br />
apple-relationships $ apple-phonecontacts $ apple-emailcontacts $<br />
apple-postaladdresses $ apple-mapcoordinates ) )<br />
214 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
Authentication Authority Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.16<br />
NAME 'authAuthorityObject'<br />
SUP top STRUCTURAL<br />
MAY ( authAuthority ) )<br />
<strong>Server</strong> Assistant Configuration Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.17<br />
NAME 'apple-serverassistant-config'<br />
SUP top STRUCTURAL<br />
MUST ( cn )<br />
MAY ( apple-xmlplist ) )<br />
Location Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.18<br />
NAME 'apple-location'<br />
SUP top AUXILIARY<br />
MUST ( cn )<br />
MAY ( apple-dns-domain $ apple-dns-nameserver ) )<br />
Service Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.19<br />
NAME 'apple-service'<br />
SUP top STRUCTURAL<br />
MUST ( cn $<br />
apple-service-type )<br />
MAY ( ipHostNumber $<br />
description $<br />
apple-service-location $<br />
apple-service-url $<br />
apple-service-port $<br />
apple-dnsname $<br />
apple-keyword ) )<br />
Neighborhood Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.20<br />
NAME 'apple-neighborhood'<br />
SUP top STRUCTURAL<br />
MUST ( cn )<br />
MAY ( description $<br />
apple-generateduid $<br />
apple-category $<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 215
ACL Object Class<br />
apple-nodepathxml $<br />
apple-neighborhoodalias $<br />
apple-computeralias $<br />
apple-keyword $<br />
apple-realname $<br />
apple-xmlplist $<br />
ttl ) )<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.21<br />
NAME 'apple-acl'<br />
SUP top STRUCTURAL<br />
MUST ( cn $<br />
apple-acl-entry ) )<br />
Resource Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.23<br />
NAME 'apple-resource'<br />
SUP top STRUCTURAL<br />
MUST ( cn )<br />
MAY ( apple-realname $ description $ jpegPhoto $ apple-keyword $<br />
apple-generateduid $ apple-contactguid $ apple-ownerguid $<br />
apple-resource-info $ apple-resource-type $ apple-capacity $<br />
labeledURI $ apple-mapuri $ apple-serviceslocator $<br />
apple-phonecontacts $ c $ apple-mapguid $ apple-mapcoordinates ) )<br />
Augment Object Class<br />
objectclass (<br />
1.3.6.1.4.1.63.1000.1.1.2.24<br />
NAME 'apple-augment'<br />
SUP top<br />
STRUCTURAL<br />
MUST ( cn ) )<br />
Automount Map Object Class<br />
objectclass (<br />
1.3.6.1.1.1.2.16<br />
NAME 'automountMap'<br />
SUP top STRUCTURAL<br />
MUST ( automountMapName )<br />
MAY description )<br />
Automount Object Class<br />
objectclass (<br />
216 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
1.3.6.1.1.1.2.17<br />
NAME 'automount'<br />
SUP top STRUCTURAL<br />
DESC 'Automount'<br />
MUST ( automountKey $ automountInformation )<br />
MAY description )<br />
Attributes in <strong>Open</strong> <strong>Directory</strong> LDAP Schema<br />
This section defines the <strong>Open</strong> <strong>Directory</strong> LDAP attributes that extend the standard LDAP<br />
schema.<br />
Time-to-Live Attribute<br />
attributetype (<br />
1.3.6.1.4.1.250.1.60<br />
NAME 'ttl'<br />
EQUALITY integerMatch<br />
SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' SINGLE-VALUE )<br />
User Attributes<br />
apple-user-homeurl<br />
Used to store home folder information in the form of a URL and path. This maps to the<br />
kDS1AttrHome<strong>Directory</strong> attribute type in directory services.<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.6<br />
NAME 'apple-user-homeurl'<br />
DESC 'home directory URL'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
apple-user-class<br />
Unused.<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.7<br />
NAME 'apple-user-class'<br />
DESC 'user class'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
apple-user-homequota<br />
Used to specify the home folder quota in kilobytes.<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.8<br />
NAME 'apple-user-homequota'<br />
DESC 'home directory quota'<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 217
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
apple-user-mailattribute<br />
Stores mail-related settings as XML.<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.9<br />
NAME 'apple-user-mailattribute'<br />
DESC 'mail attribute'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-mcxflags<br />
Used to store managed client information. This attribute can be found in user, group,<br />
computer, and computer group records.<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.10<br />
NAME 'apple-mcxflags'<br />
DESC 'mcx flags'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-mcxsettings<br />
Used to store managed client information. This attribute can be found in user, group,<br />
computer, and computer group records.<br />
#attributetype (<br />
# 1.3.6.1.4.1.63.1000.1.1.1.1.11<br />
# NAME 'apple-mcxsettings'<br />
# DESC 'mcx settings'<br />
# EQUALITY caseExactMatch<br />
# SUBSTR caseExactSubstringsMatch<br />
# SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.16<br />
NAME ( 'apple-mcxsettings' 'apple-mcxsettings2' )<br />
DESC 'mcx settings'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
218 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
apple-user-picture<br />
Stores a file system path to the picture to use for this user record when displayed in the<br />
login window. This is used when the network user is listed in the login window<br />
scrolling list (in managed networks).<br />
By default, users can change their pictures.<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.12<br />
NAME 'apple-user-picture'<br />
DESC 'picture'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-user-printattribute<br />
Stores print quota settings as an XML plist.<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.13<br />
NAME 'apple-user-printattribute'<br />
DESC 'print attribute'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-user-adminlimits<br />
Used by Workgroup Manager to store an XML plist file describing the abilities of an<br />
administrator. These settings are respected and updated by Workgroup Manager but<br />
do not affect other parts of the system.<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.14<br />
NAME 'apple-user-adminlimits'<br />
DESC 'admin limits'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-user-authenticationhint<br />
Used by the login window to provide a hint if the user logs in incorrectly three times.<br />
By default each user can update their authentication hint.<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.15<br />
NAME 'apple-user-authenticationhint'<br />
DESC 'password hint'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 219
apple-user-homesoftquota<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.17<br />
NAME 'apple-user-homesoftquota'<br />
DESC 'home directory soft quota'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
apple-user-passwordpolicy<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.18<br />
NAME 'apple-user-passwordpolicy'<br />
DESC 'password policy options'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-keyword<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.19<br />
NAME ( 'apple-keyword' )<br />
DESC 'keywords'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-generateduid<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.20<br />
NAME ( 'apple-generateduid' )<br />
DESC 'generated unique ID'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-imhandle<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.21<br />
NAME ( 'apple-imhandle' )<br />
DESC 'IM handle (service:account name)'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
220 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
apple-webloguri<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.22<br />
NAME ( 'apple-webloguri' )<br />
DESC 'Weblog URI'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
apple-mapcoordinates<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.23<br />
NAME ( 'apple-mapcoordinates' )<br />
DESC 'Map Coordinates'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-postaladdresses<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.24<br />
NAME ( 'apple-postaladdresses' )<br />
DESC 'Postal Addresses'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-phonecontacts<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.25<br />
NAME ( 'apple-phonecontacts' )<br />
DESC 'Phone Contacts'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-emailcontacts<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.26<br />
NAME ( 'apple-emailcontacts' )<br />
DESC 'EMail Contacts'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-birthday<br />
attributetype (<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 221
1.3.6.1.4.1.63.1000.1.1.1.1.27<br />
NAME ( 'apple-birthday' )<br />
DESC 'Birthday'<br />
EQUALITY generalizedTimeMatch<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )<br />
apple-relationships<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.28<br />
NAME ( 'apple-relationships' )<br />
DESC 'Relationships'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-company<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.29<br />
NAME ( 'apple-company' )<br />
DESC 'company'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-nickname<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.30<br />
NAME ( 'apple-nickname' )<br />
DESC 'nickname'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-mapuri<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.31<br />
NAME ( 'apple-mapuri' )<br />
DESC 'Map URI'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-mapguid<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.32<br />
NAME ( 'apple-mapguid' )<br />
DESC 'map GUID'<br />
222 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-serviceslocator<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.33<br />
NAME ( 'apple-serviceslocator' )<br />
DESC 'Calendar Principal URI'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-organizationinfo<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.34<br />
NAME 'apple-organizationinfo'<br />
DESC 'Originization Info data'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-namesuffix<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.35<br />
NAME ( 'apple-namesuffix' )<br />
DESC 'namesuffix'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-primarycomputerlist<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.1.36<br />
NAME ( 'apple-primarycomputerlist' )<br />
DESC 'primary computer list'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-user-home<strong>Directory</strong><br />
Not used by the <strong>Open</strong> <strong>Directory</strong> <strong>Server</strong>, but provided as an example OID and attribute<br />
to use as an alternative to the home<strong>Directory</strong> attribute for RFC 2307. This is primarily of<br />
interest to Active <strong>Directory</strong> administrators because Active <strong>Directory</strong> uses a<br />
home<strong>Directory</strong> attribute that differs from RFC 2307.<br />
#attributetype (<br />
# 1.3.6.1.4.1.63.1000.1.1.1.1.100<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 223
# NAME 'apple-user-home<strong>Directory</strong>'<br />
# DESC 'The absolute path to the home directory'<br />
# EQUALITY caseExactIA5Match<br />
# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
Group Attributes<br />
apple-group-homeurl<br />
Specifies the home folder associated with a managed client workgroup. This is<br />
mounted at login by any user in this workgroup.<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.14.1<br />
NAME 'apple-group-homeurl'<br />
DESC 'group home url'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
apple-group-homeowner<br />
Determines the owner of the workgroup home folder when created in the file system.<br />
The group of the directory is the workgroup it is associated with.<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.14.2<br />
NAME 'apple-group-homeowner'<br />
DESC 'group home owner settings'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
apple-group-realname<br />
Used to associate a longer, more user-friendly name with groups. This name appears in<br />
Workgroup Manager and can contain non-ASCII characters.<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.14.5<br />
NAME 'apple-group-realname'<br />
DESC 'group real name'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-group-nestedgroup<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.14.6<br />
NAME 'apple-group-nestedgroup'<br />
DESC 'group real name'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
224 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-group-memberguid<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.14.7<br />
NAME 'apple-group-memberguid'<br />
DESC 'group real name'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-group-services<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.14.8<br />
NAME 'apple-group-services'<br />
DESC 'group services'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-group-memberUid<br />
Not used by an <strong>Open</strong> <strong>Directory</strong> server, but defined as an example attribute and OID<br />
that could be added to another LDAP server to support <strong>Mac</strong> <strong>OS</strong> X clients.<br />
# Alternative to using memberUid from RFC 2307.<br />
#attributetype (<br />
# 1.3.6.1.4.1.63.1000.1.1.1.14.1000<br />
# NAME 'apple-group-memberUid'<br />
# DESC 'group member list'<br />
# EQUALITY caseExactIA5Match<br />
# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
# can also use OID 1.3.6.1.4.1.63.1000.1.1.2.1000<br />
apple-contactguid<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.14.9<br />
NAME ( 'apple-contactguid' )<br />
DESC 'contact GUID'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-ownerguid<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.14.10<br />
NAME ( 'apple-ownerguid' )<br />
DESC 'owner GUID'<br />
EQUALITY caseExactMatch<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 225
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-primarycomputerguid<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.14.11<br />
NAME ( 'apple-primarycomputerguid' )<br />
DESC 'primary computer GUID'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-group-expandednestedgroup<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.14.12<br />
NAME 'apple-group-expandednestedgroup'<br />
DESC 'expanded nested group list'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
<strong>Mac</strong>hine Attributes<br />
apple-machine-software<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.3.8<br />
NAME 'apple-machine-software'<br />
DESC 'installed system software'<br />
EQUALITY caseIgnoreIA5Match<br />
SUBSTR caseIgnoreIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-machine-hardware<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.3.9<br />
NAME 'apple-machine-hardware'<br />
DESC 'system hardware description'<br />
EQUALITY caseIgnoreIA5Match<br />
SUBSTR caseIgnoreIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-machine-serves<br />
attributeType (<br />
1.3.6.1.4.1.63.1000.1.1.1.3.10<br />
NAME 'apple-machine-serves'<br />
DESC 'NetInfo Domain <strong>Server</strong> Binding'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
226 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-machine-suffix<br />
attributeType (<br />
1.3.6.1.4.1.63.1000.1.1.1.3.11<br />
NAME 'apple-machine-suffix'<br />
DESC 'DIT suffix'<br />
EQUALITY caseIgnoreMatch<br />
SUBSTR caseIgnoreSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-machine-contactperson<br />
attributeType (<br />
1.3.6.1.4.1.63.1000.1.1.1.3.12<br />
NAME 'apple-machine-contactperson'<br />
DESC 'Name of contact person/owner of this machine'<br />
EQUALITY caseIgnoreMatch<br />
SUBSTR caseIgnoreSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
attributeTypesConfig<br />
attributeType (<br />
1.3.6.1.4.1.63.1000.1.1.1.22.1<br />
NAME 'attributeTypesConfig'<br />
DESC 'RFC2252: attribute types'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
objectClassesConfig<br />
attributeType (<br />
1.3.6.1.4.1.63.1000.1.1.1.22.2<br />
NAME 'objectClassesConfig'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
Mount Attributes<br />
mount<strong>Directory</strong><br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.8.1<br />
NAME 'mount<strong>Directory</strong>'<br />
DESC 'mount path'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 227
mountType<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.8.2<br />
NAME 'mountType'<br />
DESC 'mount VFS type'<br />
EQUALITY caseIgnoreIA5Match<br />
SUBSTR caseIgnoreIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
mountOption<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.8.3<br />
NAME 'mountOption'<br />
DESC 'mount options'<br />
EQUALITY caseIgnoreIA5Match<br />
SUBSTR caseIgnoreIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
mountDumpFrequency<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.8.4<br />
NAME 'mountDumpFrequency'<br />
DESC 'mount dump frequency'<br />
EQUALITY caseIgnoreIA5Match<br />
SUBSTR caseIgnoreIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
mountPassNo<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.8.5<br />
NAME 'mountPassNo'<br />
DESC 'mount passno'<br />
EQUALITY caseIgnoreIA5Match<br />
SUBSTR caseIgnoreIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
apple-mount-name<br />
# Alternative to using 'cn' when adding mount record schema to other LDAP<br />
servers<br />
#attributetype (<br />
# 1.3.6.1.4.1.63.1000.1.1.1.8.100<br />
# NAME ( 'apple-mount-name' )<br />
# DESC 'mount name'<br />
# SUP name )<br />
228 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
Printer Attributes<br />
apple-printer-attributes<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.9.1<br />
NAME 'apple-printer-attributes'<br />
DESC 'printer attributes in /etc/printcap format'<br />
EQUALITY caseIgnoreIA5Match<br />
SUBSTR caseIgnoreIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-printer-lprhost<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.9.2<br />
NAME 'apple-printer-lprhost'<br />
DESC 'printer LPR host name'<br />
EQUALITY caseIgnoreMatch<br />
SUBSTR caseIgnoreSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-printer-lprqueue<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.9.3<br />
NAME 'apple-printer-lprqueue'<br />
DESC 'printer LPR queue'<br />
EQUALITY caseIgnoreMatch<br />
SUBSTR caseIgnoreSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-printer-type<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.9.4<br />
NAME 'apple-printer-type'<br />
DESC 'printer type'<br />
EQUALITY caseIgnoreMatch<br />
SUBSTR caseIgnoreSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-printer-note<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.9.5<br />
NAME 'apple-printer-note'<br />
DESC 'printer note'<br />
EQUALITY caseIgnoreMatch<br />
SUBSTR caseIgnoreSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 229
Computer Attributes<br />
apple-realname<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.10.2<br />
NAME 'apple-realname'<br />
DESC 'real name'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-networkview<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.10.3<br />
NAME 'apple-networkview'<br />
DESC 'Network view for the computer'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-category<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.10.4<br />
NAME 'apple-category'<br />
DESC 'Category for the computer or neighborhood'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
ComputerList Attributes<br />
apple-computers<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.11.3<br />
NAME 'apple-computers'<br />
DESC 'computers'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-computer-list-groups<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.11.4<br />
NAME 'apple-computer-list-groups'<br />
DESC 'groups'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
230 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
XML Plist Attribute<br />
apple-xmlplist<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.17.1<br />
NAME 'apple-xmlplist'<br />
DESC 'XML plist data'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
Service URL Attribute<br />
apple-service-url<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.19.2<br />
NAME 'apple-service-url'<br />
DESC 'URL of service'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
Service Info Attribute<br />
apple-serviceinfo<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.19.6<br />
NAME 'apple-serviceinfo'<br />
DESC 'service related information'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
Configuration Attributes<br />
apple-password-server-location<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.12.1<br />
NAME 'apple-password-server-location'<br />
DESC 'password server location'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
apple-data-stamp<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.12.2<br />
NAME 'apple-data-stamp'<br />
DESC 'data stamp'<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 231
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
apple-config-realname<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.12.3<br />
NAME 'apple-config-realname'<br />
DESC 'config real name'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
apple-password-server-list<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.12.4<br />
NAME 'apple-password-server-list'<br />
DESC 'password server replication plist'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
apple-ldap-replica<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.12.5<br />
NAME 'apple-ldap-replica'<br />
DESC 'LDAP replication list'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-ldap-writable-replica<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.12.6<br />
NAME 'apple-ldap-writable-replica'<br />
DESC 'LDAP writable replication list'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-kdc-authkey<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.12.7<br />
NAME 'apple-kdc-authkey'<br />
DESC 'KDC master key RSA encrypted with realm public key'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
232 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-kdc-configdata<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.12.8<br />
NAME 'apple-kdc-configdata'<br />
DESC 'Contents of the kdc.conf file'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )<br />
PresetUser Attribute<br />
apple-preset-user-is-admin<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.15.1<br />
NAME 'apple-preset-user-is-admin'<br />
DESC 'flag indicating whether the preset user is an administrator'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )<br />
Authentication Authority Attributes<br />
authAuthority<br />
#attributetype (<br />
# 1.3.6.1.4.1.63.1000.1.1.2.16.1<br />
# NAME 'authAuthority'<br />
# DESC 'password server authentication authority'<br />
# EQUALITY caseExactIA5Match<br />
# SUBSTR caseExactIA5SubstringsMatch<br />
# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
authAuthority2<br />
#attributetype (<br />
# 1.3.6.1.4.1.63.1000.1.1.2.16.2<br />
# NAME ( 'authAuthority' 'authAuthority2' )<br />
# DESC 'password server authentication authority'<br />
# EQUALITY caseExactMatch<br />
# SUBSTR caseExactSubstringsMatch<br />
# SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
Location Attributes<br />
apple-dns-domain<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.18.1<br />
NAME 'apple-dns-domain'<br />
DESC 'DNS domain'<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 233
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-dns-nameserver<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.18.2<br />
NAME 'apple-dns-nameserver'<br />
DESC 'DNS name server list'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
Service Attributes<br />
apple-service-type<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.19.1<br />
NAME 'apple-service-type'<br />
DESC 'type of service'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-service-url<br />
#attributetype (<br />
# 1.3.6.1.4.1.63.1000.1.1.1.19.2<br />
# NAME 'apple-service-url'<br />
# DESC 'URL of service'<br />
# EQUALITY caseExactIA5Match<br />
# SUBSTR caseExactIA5SubstringsMatch<br />
# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-service-port<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.19.3<br />
NAME 'apple-service-port'<br />
DESC 'Service port number'<br />
EQUALITY integerMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )<br />
apple-dnsname<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.19.4<br />
NAME 'apple-dnsname'<br />
DESC 'DNS name'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
234 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-service-location<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.19.5<br />
NAME 'apple-service-location'<br />
DESC 'Service location'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
Neighborhood Attributes<br />
apple-nodepathxml<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.20.1<br />
NAME 'apple-nodepathxml'<br />
DESC 'XML plist of directory node path'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-neighborhoodalias<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.20.2<br />
NAME 'apple-neighborhoodalias'<br />
DESC 'XML plist referring to another neighborhood record'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
apple-computeralias<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.20.3<br />
NAME 'apple-computeralias'<br />
DESC 'XML plist referring to a computer record'<br />
EQUALITY caseExactMatch<br />
SUBSTR caseExactSubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
ACL Attribute<br />
apple-acl-entry<br />
#attributetype (<br />
# 1.3.6.1.4.1.63.1000.1.1.1.21.1<br />
# NAME 'apple-acl-entry'<br />
# DESC 'acl entry'<br />
# EQUALITY caseExactMatch<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 235
# SUBSTR caseExactSubstringsMatch<br />
# SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )<br />
Schema Attributes<br />
attributeTypesConfig<br />
#attributetype (<br />
# 1.3.6.1.4.1.63.1000.1.1.1.22.1<br />
# NAME 'attributeTypesConfig'<br />
# DESC 'attribute type configuration'<br />
# EQUALITY objectIdentifierFirstComponentMatch<br />
# SYNTAX 1.3.6.1.4.1.1466.115.121.1.3 )<br />
objectClassesConfig<br />
#attributetype (<br />
# 1.3.6.1.4.1.63.1000.1.1.1.22.2<br />
# NAME 'objectClassesConfig'<br />
# DESC 'object class configuration'<br />
# EQUALITY objectIdentifierFirstComponentMatch<br />
# SYNTAX 1.3.6.1.4.1.1466.115.121.1.37 )<br />
Resource Attribute<br />
apple-resource-type<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.23.1<br />
NAME 'apple-resource-type'<br />
DESC 'resource type'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-resource-info<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.23.2<br />
NAME 'apple-resource-info'<br />
DESC 'resource info'<br />
EQUALITY caseExactIA5Match<br />
SUBSTR caseExactIA5SubstringsMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )<br />
apple-capacity<br />
attributetype (<br />
1.3.6.1.4.1.63.1000.1.1.1.23.3<br />
NAME 'apple-capacity'<br />
DESC 'capacity'<br />
EQUALITY integerMatch<br />
SYNTAX '1.3.6.1.4.1.1466.115.121.1.27' SINGLE-VALUE )<br />
236 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
Automount Attribute<br />
automountMapName<br />
attributetype (<br />
1.3.6.1.1.1.1.31<br />
NAME 'automountMapName'<br />
DESC 'automount Map Name'<br />
EQUALITY caseExactMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15<br />
SINGLE-VALUE )<br />
automountKey<br />
attributetype (<br />
1.3.6.1.1.1.1.32<br />
NAME 'automountKey'<br />
DESC 'Automount Key value'<br />
EQUALITY caseExactMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15<br />
SINGLE-VALUE )<br />
automountInformation<br />
attributetype (<br />
1.3.6.1.1.1.1.33<br />
NAME 'automountInformation'<br />
DESC 'Automount information'<br />
EQUALITY caseExactMatch<br />
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15<br />
SINGLE-VALUE )<br />
Mapping Standard Record Types and Attributes to LDAP and<br />
Active <strong>Directory</strong><br />
This section specifies how <strong>Open</strong> <strong>Directory</strong> record types and attributes map to LDAP<br />
object classes and attributes. It also specifies how some Active <strong>Directory</strong> object<br />
categories and attributes are mapped to and generated from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
The following tables do not provide mappings for extending your schema. The table<br />
indicates the records and attributes that <strong>Open</strong> <strong>Directory</strong> uses from existing Active<br />
<strong>Directory</strong> and Unix RFC2307 schemas. It also indicates the attributes and records that<br />
do not have direct mappings.<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 237
Mappings for Users<br />
The following tables specify how the LDAPv3 plug-in in <strong>Directory</strong> Utility maps the<br />
<strong>Open</strong> <strong>Directory</strong> Users record type and attributes to LDAP object classes and attributes.<br />
The tables also specify how the Active <strong>Directory</strong> plug-in in <strong>Directory</strong> Utility maps and<br />
generates Active <strong>Directory</strong> object categories and attributes from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
Record Type Mappings for Users<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
Users,<br />
RFC 2798<br />
Users,<br />
RFC 2307<br />
Users,<br />
RFC 2307<br />
Users,<br />
<strong>Apple</strong> registered<br />
LDAP object class name<br />
OID<br />
inetOrgPerson<br />
2.16.840.1.113730.3.2.2<br />
posixAccount<br />
1.3.6.1.1.1.2.0<br />
shadowAccount<br />
1.3.6.1.1.1.2.1<br />
apple-user<br />
1.3.6.1.4.1.63.1000.1.1.2.1<br />
Active <strong>Directory</strong><br />
plug-in<br />
ObjectCategory = Person<br />
<strong>Apple</strong> extended schema<br />
Attribute Mappings for Users<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class,<br />
special purpose<br />
Home<strong>Directory</strong>,<br />
<strong>Apple</strong> registered<br />
Home<strong>Directory</strong>Quota,<br />
<strong>Apple</strong> registered<br />
Home<strong>Directory</strong>SoftQuota,<br />
<strong>Apple</strong> registered<br />
MailAttribute,<br />
<strong>Apple</strong> registered<br />
PrintServiceUserData,<br />
<strong>Apple</strong> registered<br />
MCXFlags,<br />
<strong>Apple</strong> registered<br />
MCXSettings,<br />
<strong>Apple</strong> registered<br />
AdminLimits,<br />
<strong>Apple</strong> registered<br />
AuthenticationAuthority,<br />
<strong>Apple</strong> registered<br />
LDAP attribute name<br />
OID<br />
apple-user-homeurl<br />
1.3.6.1.4.1.63.1000.1.1.1.1.6<br />
apple-user-homequota<br />
1.3.6.1.4.1.63.1000.1.1.1.1.8<br />
apple-user-homesoftquota<br />
1.3.6.1.4.1.63.1000.1.1.1.1.17<br />
apple-user-mailattribute<br />
1.3.6.1.4.1.63.1000.1.1.1.1.9<br />
apple-user-printattribute<br />
1.3.6.1.4.1.63.1000.1.1.1.1.13<br />
apple-mcxflags<br />
1.3.6.1.4.1.63.1000.1.1.1.1.10<br />
apple-mcxsettings<br />
1.3.6.1.4.1.63.1000.1.1.1.1.16<br />
apple-user-adminlimits<br />
1.3.6.1.4.1.63.1000.1.1.1.1.14<br />
authAuthority<br />
1.3.6.1.4.1.63.1000.1.1.2.16.1<br />
Active <strong>Directory</strong><br />
plug-in<br />
Generated from home<strong>Directory</strong><br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
Generated as a Kerberos<br />
authority<br />
238 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class,<br />
special purpose<br />
AuthenticationHint,<br />
<strong>Apple</strong> registered<br />
PasswordPolicyOptions,<br />
<strong>Apple</strong> registered<br />
Keywords,<br />
<strong>Apple</strong> registered<br />
Picture,<br />
<strong>Apple</strong> registered<br />
GeneratedUID,<br />
<strong>Apple</strong> registered<br />
RecordName,<br />
RFC 2256<br />
RecordName,<br />
RFC 1274<br />
EMailAddress,<br />
RFC 1274<br />
RealName,<br />
RFC 2256<br />
Password,<br />
RFC 2256<br />
Comment,<br />
RFC 2256<br />
LastName,<br />
RFC 2256<br />
FirstName,<br />
RFC 2256<br />
PhoneNumber,<br />
RFC 2256<br />
AddressLIne1,<br />
RFC 2256<br />
PostalAddress,<br />
RFC 2256<br />
PostalCode,<br />
RFC 2256<br />
OrganizationName,<br />
RFC 2256<br />
UserShell,<br />
RFC 2307<br />
Change,<br />
RFC 2307<br />
LDAP attribute name<br />
OID<br />
apple-user-authenticationhint<br />
1.3.6.1.4.1.63.1000.1.1.1.1.15<br />
apple-user-passwordpolicy<br />
1.3.6.1.4.1.63.1000.1.1.1.1.18<br />
apple-keyword<br />
1.3.6.1.4.1.63.1000.1.1.1.1.19<br />
apple-user-picture<br />
1.3.6.1.4.1.63.1000.1.1.1.1.12<br />
apple-generateduid<br />
1.3.6.1.4.1.63.1000.1.1.1.1.20<br />
cn<br />
2.5.4.3<br />
uid<br />
0.9.2342.19200300.100.1.1<br />
mail<br />
0.9.2342.19200300.100.1.3<br />
cn<br />
2.5.4.3<br />
userPassword<br />
2.5.4.35<br />
description<br />
2.5.4.13<br />
sn<br />
2.5.4.4<br />
givenName<br />
2.5.4.42<br />
telephoneNumber<br />
2.5.4.20<br />
street<br />
2.5.4.9<br />
postalAddress<br />
2.5.4.16<br />
postalCode<br />
2.5.4.17<br />
o<br />
2.5.4.10<br />
loginShell<br />
1.3.6.1.1.1.1.4<br />
shadowLastChange<br />
1.3.6.1.1.1.1.5<br />
Active <strong>Directory</strong><br />
plug-in<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
From GUID—formatted<br />
Generated from cn,<br />
userPrincipal, mail,<br />
sAMAccountName<br />
N/A<br />
RFC standard<br />
1.2.840.113556.1.2.13 (Microsoft)<br />
No mapping<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
1.2.840.113556.1.2.146 (Microsoft)<br />
Extended using RFC<br />
No mapping<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 239
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class,<br />
special purpose<br />
Expire,<br />
RFC 2307<br />
UniqueID,<br />
RFC 2307<br />
NFSHome<strong>Directory</strong>,<br />
RFC 2307<br />
PrimaryGroupID,<br />
RFC 2307<br />
SMBAccountFlags,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBPasswordLastSet,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBLogonTime,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBLogoffTime,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBKickoffTime,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBHomeDrive,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBScriptPath,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBProfilePath,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBUserWorkstations,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBHome,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBRID,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
LDAP attribute name<br />
OID<br />
shadowExpire<br />
1.3.6.1.1.1.1.10<br />
uidNumber<br />
1.3.6.1.1.1.1.0<br />
home<strong>Directory</strong><br />
1.3.6.1.1.1.1.3<br />
gidNumber<br />
1.3.6.1.1.1.1.1<br />
acctFlags<br />
1.3.6.1.4.1.7165.2.1.4<br />
pwdLastSet<br />
1.3.6.1.4.1.7165.2.1.3<br />
logonTime<br />
1.3.6.1.4.1.7165.2.1.5<br />
logoffTime<br />
1.3.6.1.4.1.7165.2.1.6<br />
kickoffTime<br />
1.3.6.1.4.1.7165.2.1.7<br />
homeDrive<br />
1.3.6.1.4.1.7165.2.1.10<br />
scriptPath<br />
1.3.6.1.4.1.7165.2.1.11<br />
profilePath<br />
1.3.6.1.4.1.7165.2.1.12<br />
userWorkstations<br />
1.3.6.1.4.1.7165.2.1.13<br />
smbHome<br />
1.3.6.1.4.1.7165.2.1.17<br />
rid<br />
1.3.6.1.4.1.7165.2.1.14<br />
Active <strong>Directory</strong><br />
plug-in<br />
No mapping<br />
Generated from GUID<br />
Generated from home<strong>Directory</strong><br />
Extended using RFC or<br />
generated from GUID<br />
1.2.840.113556.1.4.302 (Microsoft)<br />
1.2.840.113556.1.4.96 (Microsoft)<br />
1.2.840.113556.1.4.52 (Microsoft)<br />
1.2.840.113556.1.4.51 (Microsoft)<br />
No mapping<br />
1.2.840.113556.1.4.45 (Microsoft)<br />
1.2.840.113556.1.4.62 (Microsoft)<br />
1.2.840.113556.1.4.139 (Microsoft)<br />
1.2.840.113556.1.4.86 (Microsoft)<br />
1.2.840.113556.1.4.44 (Microsoft)<br />
1.2.840.113556.1.4.153 (Microsoft)<br />
240 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class,<br />
special purpose<br />
SMBGroupRID,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
FaxNumber,<br />
RFC 2256<br />
MobileNumber,<br />
RFC 1274<br />
PagerNumber,<br />
RFC 1274<br />
Department,<br />
RFC 2798,<br />
NickName,<br />
Microsoft Attribute<br />
JobTitle,<br />
RFC 2256<br />
Building,<br />
RFC 2256<br />
Country,<br />
RFC 2256<br />
Street,<br />
RFC 2256<br />
City,<br />
RFC 2256<br />
State,<br />
RFC 2256<br />
LDAP attribute name<br />
OID<br />
primaryGroupID<br />
1.3.6.1.4.1.7165.2.1.15<br />
fax<br />
2.5.4.23<br />
mobile<br />
0.9.2342.19200300.100.1.41<br />
pager<br />
0.9.2342.19200300.100.1.42<br />
departmentNumber<br />
2.16.840.1.113730.3.1.2<br />
title<br />
2.5.4.12<br />
buildingName<br />
2.5.4.19<br />
c<br />
2.5.4.6<br />
street<br />
2.5.4.9<br />
locality<br />
2.5.4.7<br />
st<br />
2.5.4.8<br />
Active <strong>Directory</strong><br />
plug-in<br />
1.2.840.113556.1.4.98 (Microsoft)<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
1.2.840.113556.1.2.141 (Microsoft)<br />
1.2.840.113556.1.2.447 (Microsoft)<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
1.2.840.113556.1.2.256 (Microsoft)<br />
RFC standard<br />
RFC standard<br />
Mappings for Groups<br />
The following tables specify how the LDAPv3 plug-in in <strong>Directory</strong> Utility maps the<br />
<strong>Open</strong> <strong>Directory</strong> Groups record type and attributes to LDAP object classes.<br />
The tables also specify how the Active <strong>Directory</strong> plug-in in <strong>Directory</strong> Utility maps and<br />
generates Active <strong>Directory</strong> object categories and attributes from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
Record Type Mappings for Groups<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
Groups,<br />
RFC 2307<br />
Groups,<br />
<strong>Apple</strong> registered<br />
LDAP object class name<br />
OID<br />
posixGroup<br />
1.3.6.1.1.1.2.2<br />
apple-group<br />
1.3.6.1.4.1.63.1000.1.1.2.14<br />
Active <strong>Directory</strong><br />
plug-in<br />
objectCategory = Group<br />
<strong>Apple</strong> extended schema<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 241
Attribute Mappings for Groups<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
RecordName,<br />
RFC 2256<br />
Home<strong>Directory</strong>,<br />
<strong>Apple</strong> registered<br />
HomeLocOwner,<br />
<strong>Apple</strong> registered<br />
MCXFlags,<br />
<strong>Apple</strong> registered<br />
MCXSettings,<br />
<strong>Apple</strong> registered<br />
RealName,<br />
<strong>Apple</strong> registered<br />
Picture,<br />
<strong>Apple</strong> registered<br />
Keywords,<br />
<strong>Apple</strong> registered<br />
GeneratedUID,<br />
<strong>Apple</strong> registered<br />
GroupMembership,<br />
RFC 2307<br />
Member,<br />
RFC 2307<br />
PrimaryGroupID,<br />
RFC 2307<br />
LDAP attribute name<br />
OID<br />
cn<br />
2.5.4.3<br />
apple-group-homeurl<br />
1.3.6.1.4.1.63.1000.1.1.1.14.1<br />
apple-group-homeowner<br />
1.3.6.1.4.1.63.1000.1.1.1.14.2<br />
apple-mcxflags<br />
1.3.6.1.4.1.63.1000.1.1.1.1.10<br />
apple-mcxsettings<br />
1.3.6.1.4.1.63.1000.1.1.1.1.16<br />
apple-group-realname<br />
1.3.6.1.4.1.63.1000.1.1.1.14.5<br />
apple-user-picture<br />
1.3.6.1.4.1.63.1000.1.1.1.1.12<br />
apple-keyword<br />
1.3.6.1.4.1.63.1000.1.1.1.1.19<br />
apple-generateduid<br />
1.3.6.1.4.1.63.1000.1.1.1.1.20<br />
memberUid<br />
1.3.6.1.1.1.1.12<br />
memberUid<br />
1.3.6.1.1.1.1.12<br />
gidNumber<br />
1.3.6.1.1.1.1.1<br />
Active <strong>Directory</strong><br />
plug-in<br />
RFC standard<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
1.2.840.113556.1.2.13 (Microsoft)<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
From GUID—formatted<br />
Generated from member<br />
Same as GroupMembership<br />
Extended using RFC or<br />
generated from GUID<br />
Mappings for Mounts<br />
The following tables specify how the LDAPv3 plug-in in <strong>Directory</strong> Utility maps the<br />
<strong>Open</strong> <strong>Directory</strong> Mounts record type and attributes to LDAP object classes and<br />
attributes.<br />
The tables also specify how the Active <strong>Directory</strong> plug-in in <strong>Directory</strong> Utility maps and<br />
generates Active <strong>Directory</strong> object categories and attributes from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
Record Type Mappings for Mounts<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
Mounts,<br />
<strong>Apple</strong> registered<br />
LDAP object class name<br />
OID<br />
mount<br />
1.3.6.1.4.1.63.1000.1.1.2.8<br />
Active <strong>Directory</strong><br />
plug-in<br />
<strong>Apple</strong> extended schema<br />
242 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
Attribute Mappings for Mounts<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
RecordName,<br />
RFC 2256<br />
VFSLinkDir,<br />
<strong>Apple</strong> registered<br />
VFSOpts,<br />
<strong>Apple</strong> registered<br />
VFSType,<br />
<strong>Apple</strong> registered<br />
VFSDumpFreq,<br />
<strong>Apple</strong> registered<br />
VFSPassNo,<br />
<strong>Apple</strong> registered<br />
LDAP attribute name<br />
OID<br />
cn<br />
2.5.4.3<br />
mount<strong>Directory</strong><br />
1.3.6.1.4.1.63.1000.1.1.1.8.1<br />
mountOption<br />
1.3.6.1.4.1.63.1000.1.1.1.8.3<br />
mountType<br />
1.3.6.1.4.1.63.1000.1.1.1.8.2<br />
mountDumpFrequency<br />
1.3.6.1.4.1.63.1000.1.1.1.8.4<br />
mountPassNo<br />
1.3.6.1.4.1.63.1000.1.1.1.8.5<br />
Active <strong>Directory</strong><br />
plug-in<br />
RFC standard<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
Mappings for Computers<br />
The following tables specify how the LDAPv3 plug-in in <strong>Directory</strong> Utility maps the<br />
<strong>Open</strong> <strong>Directory</strong> Computers record type and attributes to LDAP object classes.<br />
The tables also specify how the Active <strong>Directory</strong> plug-in in <strong>Directory</strong> Utility maps and<br />
generates Active <strong>Directory</strong> object categories and attributes from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
Record Type Mappings for Computers<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
Computers,<br />
<strong>Apple</strong> registered<br />
LDAP object class name<br />
OID<br />
apple-computer<br />
1.3.6.1.4.1.63.1000.1.1.2.10<br />
Active <strong>Directory</strong><br />
plug-in<br />
objectCategory = Computer<br />
Attribute Mappings for Computers<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class,<br />
special purpose<br />
RecordName,<br />
RFC 2256<br />
RealName,<br />
<strong>Apple</strong> registered<br />
MCXFlags,<br />
<strong>Apple</strong> registered<br />
MCXSettings,<br />
<strong>Apple</strong> registered<br />
LDAP attribute name<br />
OID<br />
cn<br />
2.5.4.3<br />
apple-realname<br />
1.3.6.1.4.1.63.1000.1.1.1.10.2<br />
apple-mcxflags<br />
1.3.6.1.4.1.63.1000.1.1.1.1.10<br />
apple-mcxsettings<br />
1.3.6.1.4.1.63.1000.1.1.1.1.16<br />
Active <strong>Directory</strong><br />
plug-in<br />
RFC standard<br />
1.2.840.113556.1.2.13 (Microsoft)<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 243
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class,<br />
special purpose<br />
Group,<br />
<strong>Apple</strong> registered<br />
AuthenticationAuthority,<br />
<strong>Apple</strong> registered<br />
GeneratedUID,<br />
<strong>Apple</strong> registered<br />
XMLPlist,<br />
<strong>Apple</strong> registered<br />
Comment,<br />
RFC 2256<br />
ENetAddress,<br />
RFC 2307<br />
UniqueID,<br />
RFC 2307<br />
PrimaryGroupID,<br />
RFC 2307<br />
SMBAccountFlags,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBPasswordLastSet,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBLogonTime,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBLogoffTime,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBKickoffTime,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBRID,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
SMBGroupID,<br />
Samba registered,<br />
<strong>Apple</strong> PDC<br />
LDAP attribute name<br />
OID<br />
apple-computer-list-groups<br />
1.3.6.1.4.1.63.1000.1.1.1.11.4<br />
authAuthority<br />
1.3.6.1.4.1.63.1000.1.1.2.16.1<br />
apple-generateduid<br />
1.3.6.1.4.1.63.1000.1.1.1.1.20<br />
apple-xmlplist<br />
1.3.6.1.4.1.63.1000.1.1.1.17.1<br />
description<br />
2.5.4.13<br />
macAddress<br />
1.3.6.1.1.1.1.22<br />
uidNumber<br />
1.3.6.1.1.1.1.0<br />
gidNumber<br />
1.3.6.1.1.1.1.1<br />
acctFlags<br />
1.3.6.1.4.1.7165.2.1.4<br />
pwdLastSet<br />
1.3.6.1.4.1.7165.2.1.3<br />
logonTime<br />
1.3.6.1.4.1.7165.2.1.5<br />
logoffTime<br />
1.3.6.1.4.1.7165.2.1.6<br />
kickoffTime<br />
1.3.6.1.4.1.7165.2.1.7<br />
rid<br />
1.3.6.1.4.1.7165.2.1.14<br />
primaryGroupID<br />
1.3.6.1.4.1.7165.2.1.15<br />
Active <strong>Directory</strong><br />
plug-in<br />
<strong>Apple</strong> extended schema<br />
N/A<br />
From GUID—formatted<br />
<strong>Apple</strong> extended schema<br />
RFC standard<br />
Extended using RFC<br />
Generated from GUID<br />
Extended using RFC or<br />
generated<br />
1.2.840.113556.1.4.302 (Microsoft)<br />
1.2.840.113556.1.4.96 (Microsoft)<br />
1.2.840.113556.1.4.52 (Microsoft)<br />
1.2.840.113556.1.4.51 (Microsoft)<br />
No mapping<br />
1.2.840.113556.1.4.153 (Microsoft)<br />
1.2.840.113556.1.4.98 (Microsoft)<br />
Mappings for ComputerLists<br />
The following tables specify how the LDAPv3 plug-in in <strong>Directory</strong> Utility maps the<br />
<strong>Open</strong> <strong>Directory</strong> ComputerLists record type and attributes to LDAP object classes.<br />
244 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
The tables also specify how the Active <strong>Directory</strong> plug-in in <strong>Directory</strong> Utility maps and<br />
generates Active <strong>Directory</strong> object categories and attributes from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
Record Type Mappings for ComputerLists<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
ComputerLists,<br />
<strong>Apple</strong> registered<br />
LDAP object class name<br />
OID<br />
apple-computer-list<br />
1.3.6.1.4.1.63.1000.1.1.2.11<br />
Active <strong>Directory</strong><br />
plug-in<br />
<strong>Apple</strong> extended schema<br />
Attribute Mappings for ComputerLists<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
RecordName,<br />
RFC 2256<br />
MCXFlags,<br />
<strong>Apple</strong> registered<br />
MCXSettings,<br />
<strong>Apple</strong> registered<br />
Computers,<br />
<strong>Apple</strong> registered<br />
Group,<br />
<strong>Apple</strong> registered<br />
Keywords,<br />
<strong>Apple</strong> registered<br />
LDAP attribute name<br />
OID<br />
cn<br />
2.5.4.3<br />
apple-mcxflags<br />
1.3.6.1.4.1.63.1000.1.1.1.1.10<br />
apple-mcxsettings<br />
1.3.6.1.4.1.63.1000.1.1.1.1.16<br />
apple-computers<br />
1.3.6.1.4.1.63.1000.1.1.1.11.3<br />
apple-computer-list-groups<br />
1.3.6.1.4.1.63.1000.1.1.1.11.4<br />
apple-keyword<br />
1.3.6.1.4.1.63.1000.1.1.1.1.19<br />
Active <strong>Directory</strong><br />
plug-in<br />
RFC standard<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
Mappings for Config<br />
The following tables specify how the LDAPv3 plug-in in <strong>Directory</strong> Utility maps the<br />
<strong>Open</strong> <strong>Directory</strong> Config record type and attributes to LDAP object classes.<br />
The tables also specify how the Active <strong>Directory</strong> plug-in in <strong>Directory</strong> Utility maps and<br />
generates Active <strong>Directory</strong> object categories and attributes from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
Record Type Mappings for Config<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
Config,<br />
<strong>Apple</strong> registered<br />
LDAP object class name<br />
OID<br />
apple-configuration<br />
1.3.6.1.4.1.63.1000.1.1.2.12<br />
Active <strong>Directory</strong><br />
plug-in<br />
<strong>Apple</strong> extended schema<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 245
Attribute Mappings for Config<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class,<br />
special purpose<br />
RecordName,<br />
RFC 2256<br />
RealName,<br />
<strong>Apple</strong> registered<br />
DataStamp,<br />
<strong>Apple</strong> registered<br />
KDCAuthKey,<br />
<strong>Apple</strong> registered,<br />
<strong>Apple</strong> KDC<br />
KDCConfigData,<br />
<strong>Apple</strong> registered,<br />
<strong>Apple</strong> KDC<br />
Keywords,<br />
<strong>Apple</strong> registered<br />
LDAPReadReplicas,<br />
<strong>Apple</strong> registered,<br />
<strong>Apple</strong> LDAP <strong>Server</strong><br />
LDAPWriteReplicas,<br />
<strong>Apple</strong> registered,<br />
<strong>Apple</strong> LDAP <strong>Server</strong><br />
Password<strong>Server</strong>List,<br />
<strong>Apple</strong> registered,<br />
Password <strong>Server</strong><br />
Password<strong>Server</strong>Location,<br />
<strong>Apple</strong> registered,<br />
Password <strong>Server</strong><br />
XMLPlist,<br />
<strong>Apple</strong> registered<br />
LDAP attribute name<br />
OID<br />
cn<br />
2.5.4.3<br />
apple-config-realname<br />
1.3.6.1.4.1.63.1000.1.1.1.12.3<br />
apple-data-stamp<br />
1.3.6.1.4.1.63.1000.1.1.1.12.2<br />
apple-kdc-authkey<br />
1.3.6.1.4.1.63.1000.1.1.1.12.7<br />
apple-kdc-configdata<br />
1.3.6.1.4.1.63.1000.1.1.1.12.8<br />
apple-keyword<br />
1.3.6.1.4.1.63.1000.1.1.1.1.19<br />
apple-ldap-replica<br />
1.3.6.1.4.1.63.1000.1.1.1.12.5<br />
apple-ldap-writable-replica<br />
1.3.6.1.4.1.63.1000.1.1.1.12.6<br />
apple-password-server-list<br />
1.3.6.1.4.1.63.1000.1.1.1.12.4<br />
apple-password-server-location<br />
1.3.6.1.4.1.63.1000.1.1.1.12.1<br />
apple-xmlplist<br />
1.3.6.1.4.1.63.1000.1.1.1.17.1<br />
Active <strong>Directory</strong><br />
plug-in<br />
RFC standard<br />
1.2.840.113556.1.2.13 (Microsoft)<br />
<strong>Apple</strong> extended schema<br />
No mapping<br />
No mapping<br />
<strong>Apple</strong> extended schema<br />
No mapping<br />
No mapping<br />
No mapping<br />
No mapping<br />
<strong>Apple</strong> extended schema<br />
Mappings for People<br />
The following tables specify how the LDAPv3 plug-in in <strong>Directory</strong> Utility maps the<br />
<strong>Open</strong> <strong>Directory</strong> People record type and attributes to LDAP object classes.<br />
The tables also specify how the Active <strong>Directory</strong> plug-in in <strong>Directory</strong> Utility maps and<br />
generates Active <strong>Directory</strong> object categories and attributes from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
246 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
Record Type Mappings for People<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
People,<br />
RFC 2798<br />
LDAP object class name<br />
OID<br />
inetOrgPerson<br />
2.16.840.1.113730.3.2.2<br />
Active <strong>Directory</strong><br />
plug-in<br />
RFC standard<br />
Attribute Mappings for People<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
RecordName,<br />
RFC 2256<br />
EMailAddress,<br />
RFC 1274<br />
RealName,<br />
RFC 2256<br />
LastName,<br />
RFC 2256<br />
FirstName,<br />
RFC 2256<br />
FaxNumber,<br />
RFC 2256<br />
MobileNumber,<br />
RFC 1274<br />
PagerNumber,<br />
RFC 1274<br />
Department,<br />
RFC 2798,<br />
JobTitle,<br />
RFC 2256<br />
PhoneNumber,<br />
RFC 2256<br />
AddressLine1,<br />
RFC 2256<br />
Street,<br />
RFC 2256<br />
PostalAddress,<br />
RFC 2256<br />
City,<br />
RFC 2256<br />
State,<br />
RFC 2256<br />
Country,<br />
RFC 2256<br />
LDAP attribute name<br />
OID<br />
cn<br />
2.5.4.3<br />
mail<br />
0.9.2342.19200300.100.1.3<br />
cn<br />
1.2.840.113556.1.3.23<br />
sn<br />
2.5.4.4<br />
givenName<br />
2.5.4.42<br />
fax<br />
2.5.4.23<br />
mobile<br />
0.9.2342.19200300.100.1.41<br />
pager<br />
0.9.2342.19200300.100.1.42<br />
departmentNumber<br />
2.16.840.1.113730.3.1.2<br />
title<br />
2.5.4.12<br />
telephoneNumber<br />
2.5.4.20<br />
street<br />
2.5.4.9<br />
street<br />
2.5.4.9<br />
postalAddress<br />
2.5.4.16<br />
locality<br />
2.5.4.7<br />
st<br />
2.5.4.8<br />
c<br />
2.5.4.6<br />
Active <strong>Directory</strong><br />
plug-in<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
1.2.840.113556.1.2.141 (Microsoft)<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
RFC standard<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 247
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
PostalCode,<br />
RFC 2256<br />
OrganizationName,<br />
RFC 2256<br />
LDAP attribute name<br />
OID<br />
postalCode<br />
2.5.4.17<br />
o<br />
2.5.4.10<br />
Active <strong>Directory</strong><br />
plug-in<br />
RFC standard<br />
1.2.840.113556.1.2.146 (Microsoft)<br />
Mappings for PresetComputerLists<br />
The following tables specify how the LDAPv3 plug-in in <strong>Directory</strong> Utility maps the<br />
<strong>Open</strong> <strong>Directory</strong> PresetComputerLists record type and attributes to LDAP object classes.<br />
The tables also specify how the Active <strong>Directory</strong> plug-in in <strong>Directory</strong> Utility maps and<br />
generates Active <strong>Directory</strong> object categories and attributes from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
Record Type Mappings for PresetComputerLists<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
PresetComputerLists,<br />
<strong>Apple</strong> registered<br />
LDAP object class name<br />
OID<br />
apple-preset-computer-list<br />
1.3.6.1.4.1.63.1000.1.1.2.13<br />
Active <strong>Directory</strong><br />
plug-in<br />
<strong>Apple</strong> extended schema<br />
Attribute Mappings for PresetComputerLists<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
RecordName,<br />
RFC 2256<br />
MCXFlags,<br />
<strong>Apple</strong> registered<br />
MCXSettings,<br />
<strong>Apple</strong> registered<br />
Keywords,<br />
<strong>Apple</strong> registered<br />
LDAP attribute name<br />
OID<br />
cn<br />
2.5.4.3<br />
apple-mcxflags<br />
1.3.6.1.4.1.63.1000.1.1.1.1.10<br />
apple-mcxsettings<br />
1.3.6.1.4.1.63.1000.1.1.1.1.16<br />
apple-keyword<br />
1.3.6.1.4.1.63.1000.1.1.1.1.19<br />
Active <strong>Directory</strong><br />
plug-in<br />
RFC standard<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
Mappings for PresetGroups<br />
The following tables specify how the LDAPv3 plug-in in <strong>Directory</strong> Utility maps the<br />
<strong>Open</strong> <strong>Directory</strong> PresetGroups record type and attributes to LDAP object classes.<br />
The tables also specify how the Active <strong>Directory</strong> plug-in in <strong>Directory</strong> Utility maps and<br />
generates Active <strong>Directory</strong> object categories and attributes from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
248 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
Record Type Mappings for PresetGroups<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
PresetGroups,<br />
<strong>Apple</strong> registered<br />
LDAP object class name<br />
OID<br />
apple-preset-group<br />
1.3.6.1.4.1.63.1000.1.1.3.14<br />
Active <strong>Directory</strong><br />
plug-in<br />
<strong>Apple</strong> extended schema<br />
Attribute Mappings for PresetGroups<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
Home<strong>Directory</strong>,<br />
<strong>Apple</strong> registered<br />
HomeLocOwner,<br />
<strong>Apple</strong> registered<br />
MCXFlags,<br />
<strong>Apple</strong> registered<br />
MCXSettings,<br />
<strong>Apple</strong> registered<br />
RealName,<br />
<strong>Apple</strong> registered<br />
Keywords,<br />
<strong>Apple</strong> registered<br />
RecordName,<br />
RFC 2256<br />
GroupMembership,<br />
RFC 2307<br />
PrimaryGroupID,<br />
RFC 2307<br />
LDAP attribute name<br />
OID<br />
apple-group-homeurl<br />
1.3.6.1.4.1.63.1000.1.1.1.1.6<br />
apple-group-homeowner<br />
1.3.6.1.4.1.63.1000.1.1.1.14.2<br />
apple-mcxflags<br />
1.3.6.1.4.1.63.1000.1.1.1.1.10<br />
apple-mcxsettings<br />
1.3.6.1.4.1.63.1000.1.1.1.1.16<br />
apple-group-realname<br />
1.3.6.1.4.1.63.1000.1.1.1.14.5<br />
apple-keyword<br />
1.3.6.1.4.1.63.1000.1.1.1.1.19<br />
cn<br />
2.5.4.3<br />
memberUid<br />
1.3.6.1.1.1.1.12<br />
gidNumber<br />
1.3.6.1.1.1.1.1<br />
Active <strong>Directory</strong><br />
plug-in<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
RFC standard<br />
Extended using RFC<br />
Extended using RFC<br />
Mappings for PresetUsers<br />
The following tables specify how the LDAPv3 plug-in in <strong>Directory</strong> Utility maps the<br />
<strong>Open</strong> <strong>Directory</strong> PresetUsers record type and attributes to LDAP object classes.<br />
The tables also specify how the Active <strong>Directory</strong> plug-in in <strong>Directory</strong> Utility maps and<br />
generates Active <strong>Directory</strong> object categories and attributes from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
Record Type Mappings for PresetUsers<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
PresetUsers,<br />
<strong>Apple</strong> registered<br />
LDAP object class name<br />
OID<br />
apple-preset-user<br />
1.3.6.1.4.1.63.1000.1.1.2.15<br />
Active <strong>Directory</strong><br />
plug-in<br />
ObjectCategory = Person<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 249
Attribute Mappings for PresetUsers<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
Home<strong>Directory</strong>,<br />
<strong>Apple</strong> registered<br />
Home<strong>Directory</strong>Quota,<br />
<strong>Apple</strong> registered<br />
Home<strong>Directory</strong>SoftQuota,<br />
<strong>Apple</strong> registered<br />
MailAttribute,<br />
<strong>Apple</strong> registered<br />
PrintServiceUserData,<br />
<strong>Apple</strong> registered<br />
MCXFlags,<br />
<strong>Apple</strong> registered<br />
MCXSettings,<br />
<strong>Apple</strong> registered<br />
AdminLimits,<br />
<strong>Apple</strong> registered<br />
Picture,<br />
<strong>Apple</strong> registered<br />
AuthenticationAuthority,<br />
<strong>Apple</strong> registered<br />
PasswordPolicyOptions,<br />
<strong>Apple</strong> registered<br />
PresetUserIsAdmin,<br />
<strong>Apple</strong> registered<br />
Keywords,<br />
<strong>Apple</strong> registered<br />
RecordName,<br />
RFC 1274<br />
RealName,<br />
RFC 2256<br />
Password,<br />
RFC 2256<br />
GroupMembership,<br />
RFC 2307<br />
PrimaryGroupID,<br />
RFC 2307<br />
NFSHome<strong>Directory</strong>,<br />
RFC 2307<br />
UserShell,<br />
RFC 2307<br />
LDAP attribute name<br />
OID<br />
apple-user-homeurl<br />
1.3.6.1.4.1.63.1000.1.1.1.1.6<br />
apple-user-homequota<br />
1.3.6.1.4.1.63.1000.1.1.1.1.8<br />
apple-user-homesoftquota<br />
1.3.6.1.4.1.63.1000.1.1.1.1.17<br />
apple-user-mailattribute<br />
1.3.6.1.4.1.63.1000.1.1.1.1.9<br />
apple-user-printattribute<br />
1.3.6.1.4.1.63.1000.1.1.1.1.13<br />
apple-mcxflags<br />
1.3.6.1.4.1.63.1000.1.1.1.1.10<br />
apple-mcxsettings<br />
1.3.6.1.4.1.63.1000.1.1.1.1.16<br />
apple-user-adminlimits<br />
1.3.6.1.4.1.63.1000.1.1.1.1.14<br />
apple-user-picture<br />
1.3.6.1.4.1.63.1000.1.1.1.1.12<br />
authAuthority<br />
1.3.6.1.4.1.63.1000.1.1.2.16.1<br />
apple-user-passwordpolicy<br />
1.3.6.1.4.1.63.1000.1.1.1.1.18<br />
apple-preset-user-is-admin<br />
1.3.6.1.4.1.63.1000.1.1.1.15.1<br />
apple-keyword<br />
1.3.6.1.4.1.63.1000.1.1.1.1.19<br />
cn<br />
2.5.4.3<br />
cn<br />
2.5.4.3<br />
userPassword<br />
2.5.4.35<br />
memberUid<br />
1.3.6.1.1.1.1.12<br />
gidNumber<br />
1.3.6.1.1.1.1.1<br />
home<strong>Directory</strong><br />
1.3.6.1.1.1.1.3<br />
loginShell<br />
1.3.6.1.1.1.1.4<br />
Active <strong>Directory</strong><br />
plug-in<br />
N/A<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
N/A<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
RFC standard<br />
RFC standard<br />
N/A<br />
Extended using RFC<br />
Extended using RFC<br />
N/A<br />
Extended using RFC<br />
250 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
Change,<br />
RFC 2307<br />
Expire,<br />
RFC 2307<br />
LDAP attribute name<br />
OID<br />
shadowLastChange<br />
1.3.6.1.1.1.1.5<br />
shadowExpire<br />
1.3.6.1.1.1.1.10<br />
Active <strong>Directory</strong><br />
plug-in<br />
N/A<br />
N/A<br />
Mappings for Printers<br />
The following tables specify how the LDAPv3 plug-in in <strong>Directory</strong> Utility maps the<br />
<strong>Open</strong> <strong>Directory</strong> Printers record type and attributes to LDAP object classes.<br />
The tables also specify how the Active <strong>Directory</strong> plug-in in <strong>Directory</strong> Utility maps and<br />
generates Active <strong>Directory</strong> object categories and attributes from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
Record Type Mappings for Printers<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
Printers,<br />
<strong>Apple</strong> registered<br />
Printers,<br />
IETF-Draft-IPP-LDAP<br />
LDAP object class name<br />
OID<br />
apple-printer<br />
1.3.6.1.4.1.63.1000.1.1.2.9<br />
printerIPP<br />
1.3.18.0.2.6.256<br />
Active <strong>Directory</strong><br />
plug-in<br />
ObjectCategory = Print-Queue<br />
Attribute Mappings for Printers<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class,<br />
special purpose<br />
RecordName,<br />
RFC 2256<br />
RealName,<br />
RFC 2256<br />
PrinterLPRHost,<br />
<strong>Apple</strong> registered,<br />
legacy support<br />
PrinterLPRQueue,<br />
<strong>Apple</strong> registered,<br />
legacy support<br />
PrinterType,<br />
<strong>Apple</strong> registered,<br />
legacy support<br />
PrinterNote,<br />
<strong>Apple</strong> registered,<br />
legacy support<br />
LDAP attribute name<br />
OID<br />
cn<br />
2.5.4.3<br />
Not premapped<br />
apple-printer-lprhost<br />
1.3.6.1.4.1.63.1000.1.1.1.9.2<br />
apple-printer-lprqueue<br />
1.3.6.1.4.1.63.1000.1.1.1.9.3<br />
apple-printer-type<br />
1.3.6.1.4.1.63.1000.1.1.1.9.4<br />
apple-printer-note<br />
1.3.6.1.4.1.63.1000.1.1.1.9.5<br />
Active <strong>Directory</strong><br />
plug-in<br />
RFC standard<br />
1.2.840.113556.1.4.300 (Microsoft)<br />
N/A<br />
N/A<br />
N/A<br />
N/A<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 251
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class,<br />
special purpose<br />
Location,<br />
IETF-Draft-IPP-LDAP<br />
Comment,<br />
RFC 2256<br />
PrinterMakeAndModel,<br />
IETF-Draft-IPP-LDAP<br />
PrinterURI,<br />
IETF-Draft-IPP-LDAP<br />
PrinterXRISupported,<br />
IETF-Draft-IPP-LDAP<br />
Printer1284DeviceID,<br />
<strong>Apple</strong> registered<br />
LDAP attribute name<br />
OID<br />
Not premapped; could map to:<br />
printer-location<br />
1.3.18.0.2.4.1136<br />
Not premapped; could map to:<br />
description<br />
2.5.4.13<br />
Not premapped; could map to:<br />
printer-make-and-model<br />
1.3.18.0.2.4.1138<br />
Not premapped; could map to:<br />
printer-uri<br />
1.3.18.0.2.4.1140<br />
Not premapped; could map to:<br />
printer-xri-supported<br />
1.3.18.0.2.4.1107<br />
Not premapped; could map to:<br />
printer-1284-device-id<br />
1.3.6.1.4.1.63.1000.1.1.1.9.6<br />
Active <strong>Directory</strong><br />
plug-in<br />
1.2.840.113556.1.4.222 (Microsoft)<br />
RFC standard<br />
1.2.840.113556.1.4.229 (Microsoft)<br />
Generated from uNCName<br />
Generated from portName/<br />
uNCName<br />
<strong>Apple</strong> extended schema<br />
Mappings for Auto<strong>Server</strong>Setup<br />
The following tables specify how the LDAPv3 plug-in in <strong>Directory</strong> Utility maps the<br />
<strong>Open</strong> <strong>Directory</strong> Auto<strong>Server</strong>Setup record type and attributes to LDAP object classes.<br />
The tables also specify how the Active <strong>Directory</strong> plug-in in <strong>Directory</strong> Utility maps and<br />
generates Active <strong>Directory</strong> object categories and attributes from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
Record Type Mappings for Auto<strong>Server</strong>Setup<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
Auto<strong>Server</strong>Setup,<br />
<strong>Apple</strong> registered<br />
LDAP object class name<br />
OID<br />
apple-serverassistant-config<br />
1.3.6.1.4.1.63.1000.1.1.2.17<br />
Active <strong>Directory</strong><br />
plug-in<br />
<strong>Apple</strong> extended schema<br />
Attribute Mappings for Auto<strong>Server</strong>Setup<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
RecordName,<br />
RFC 2256<br />
XMLPlist,<br />
<strong>Apple</strong> registered<br />
LDAP attribute name<br />
OID<br />
cn<br />
2.5.4.3<br />
apple-xmlplist<br />
1.3.6.1.4.1.63.1000.1.1.1.17.1<br />
Active <strong>Directory</strong><br />
plug-in<br />
RFC standard<br />
<strong>Apple</strong> extended schema<br />
252 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
Mappings for Locations<br />
The following tables specify how the LDAPv3 plug-in in <strong>Directory</strong> Utility maps the<br />
<strong>Open</strong> <strong>Directory</strong> Locations record type and attributes to LDAP object classes.<br />
The tables also specify how the Active <strong>Directory</strong> plug-in in <strong>Directory</strong> Utility maps and<br />
generates Active <strong>Directory</strong> object categories and attributes from <strong>Open</strong> <strong>Directory</strong> record<br />
types and attributes.<br />
Record Type Mappings for Locations<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
Locations,<br />
<strong>Apple</strong> registered<br />
LDAP object class name<br />
OID<br />
apple-location<br />
1.3.6.1.4.1.63.1000.1.1.2.18<br />
Active <strong>Directory</strong><br />
plug-in<br />
<strong>Apple</strong> extended schema<br />
Attribute Mappings for Locations<br />
<strong>Open</strong> <strong>Directory</strong> name,<br />
RFC/class<br />
RecordName,<br />
RFC 2256<br />
DNSDomain,<br />
<strong>Apple</strong> registered<br />
DNSName<strong>Server</strong>,<br />
<strong>Apple</strong> registered<br />
LDAP attribute name<br />
OID<br />
cn<br />
2.5.4.3<br />
apple-dns-domain<br />
1.3.6.1.4.1.63.1000.1.1.1.18.1<br />
apple-dns-nameserver<br />
1.3.6.1.4.1.63.1000.1.1.1.18.2<br />
Active <strong>Directory</strong><br />
plug-in<br />
RFC standard<br />
<strong>Apple</strong> extended schema<br />
<strong>Apple</strong> extended schema<br />
Standard <strong>Open</strong> <strong>Directory</strong> Record Types and Attributes<br />
For information about standard attributes and record types in <strong>Open</strong> <strong>Directory</strong> domains,<br />
see:<br />
 “Standard Attributes in User Records” on page 253<br />
 “Standard Attributes in Group Records” on page 258<br />
 “Standard Attributes in Computer Records” on page 259<br />
 “Standard Attributes in Computer Group Records” on page 260<br />
 “Standard Attributes in Mount Records” on page 261<br />
 “Standard Attributes in Config Records” on page 262<br />
For a complete list of standard record types and attributes, see the following file:<br />
/System/Library/Frameworks/<strong>Directory</strong>Service.framework/Headers/DirServicesConst.h<br />
Standard Attributes in User Records<br />
The following table describes the standard attributes found in <strong>Open</strong> <strong>Directory</strong> user<br />
records. Use this information when working in the Workgroup Manager Inspector pane<br />
or when mapping user record attributes with <strong>Directory</strong> Utility.<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 253
Important: When mapping <strong>Mac</strong> <strong>OS</strong> X user attributes to a read/write LDAP directory<br />
domain (an LDAP domain that is not read-only), do not map the RealName and the first<br />
RecordName attributes to the same LDAP attribute.<br />
For example, do not map both RealName and RecordName to the cn attribute. If<br />
RealName and RecordName are mapped to the same LDAP attribute, problems will<br />
occur when you try to edit the full (long) name or the first short name in Workgroup<br />
Manager.<br />
<strong>Mac</strong> <strong>OS</strong> X user attribute Format Example values<br />
RecordName:<br />
First value: ASCII characters A–Z,<br />
a–z, 0–9, _,-<br />
A list of names associated with a<br />
user. The first is the user’s short<br />
name, which is also the name of<br />
the user’s home folder.<br />
Important: All attributes used for<br />
authentication must map to<br />
RecordName.<br />
RealName:<br />
A single name, usually the user’s<br />
full name; not used for<br />
authentication.<br />
UniqueID:<br />
A unique user identifier, used for<br />
access privilege management.<br />
PrimaryGroupID:<br />
A user’s primary group<br />
association.<br />
NFSHome<strong>Directory</strong>:<br />
Local file system path to the<br />
user’s home folder.<br />
Second value: UTF-8 Roman text<br />
UTF-8 text<br />
SIgned 32-bit ASCII string of<br />
digits 0–9<br />
Signed 32-bit ASCII string of<br />
digits 0–9<br />
UTF-8 text<br />
Dave<br />
David <strong>Mac</strong><br />
D<strong>Mac</strong>Smith<br />
Nonzero length, 1 to 16 values.<br />
Maximum 255 bytes (85<br />
triple-byte to 255 single-byte<br />
characters) per instance.<br />
First value must be 1 to 8 bytes<br />
for clients using <strong>Mac</strong> <strong>OS</strong> X v10.1<br />
or earlier.<br />
David L. <strong>Mac</strong>Smith, Jr.<br />
Nonzero length, maximum 255<br />
bytes (85 triple-byte to 255<br />
single-byte characters).<br />
Values below 500 may have<br />
special significance. Values<br />
below 100 are typically used for<br />
system accounts. Zero is<br />
reserved for use by the system.<br />
Normally unique among entire<br />
population of users, but<br />
sometimes can be duplicated.<br />
Warning: A noninteger value is<br />
interpreted as 0, which is the<br />
UniqueID of the root user<br />
account.<br />
Range is 1 to 2,147,483,648.<br />
Normally unique among all<br />
group records. If blank, 20 is<br />
assumed.<br />
/Network/<strong>Server</strong>s/example/<br />
Users/K-M/Tom King<br />
Nonzero length. Maximum 255<br />
bytes.<br />
254 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
<strong>Mac</strong> <strong>OS</strong> X user attribute Format Example values<br />
Home<strong>Directory</strong>:<br />
The location of an AFP-based<br />
home folder.<br />
Home<strong>Directory</strong>Quota:<br />
The disk quota for the user’s<br />
home folder.<br />
MailAttribute:<br />
A user’s mail service<br />
configuration.<br />
PrintServiceUserData:<br />
A user’s print quota statistics.<br />
MCXFlags:<br />
If present, MCXSettings is<br />
loaded; if absent, MCXSettings<br />
isn’t loaded. Required for a<br />
managed user.<br />
MCXSettings:<br />
A user’s managed preferences.<br />
AdminLimits:<br />
The privileges given by<br />
Workgroup Manager to a user<br />
that can administer the<br />
directory domain.<br />
Password:<br />
The user’s password.<br />
Picture:<br />
Path to a recognized graphic file<br />
to be used as a display picture<br />
for the user.<br />
Comment:<br />
Any documentation you like.<br />
UTF-8 XML text<br />
Text for the number of bytes<br />
allowed<br />
UTF-8 XML text<br />
UTF-8 XML plist, single value .<br />
UTF-8 XML plist, single value<br />
UTF-8 XML plist, multivalued<br />
UTF-8 XML plist, single value<br />
UNIX crypt<br />
UTF-8 text<br />
UTF-8 text<br />
<br />
afp://server/sharept<br />
usershomedir<br />
<br />
In the following example, Tom<br />
King’s home folder is K-M/Tom<br />
King, which resides beneath the<br />
Users share point directory:<br />
<br />
afp://example.com/<br />
Users<br />
K-M/Tom King<br />
<br />
If the quota is 10 MB, the value<br />
will be the text string “1048576.”<br />
Maximum 255 bytes.<br />
John is in charge of product<br />
marketing.<br />
Maximum 32,676 bytes.<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 255
<strong>Mac</strong> <strong>OS</strong> X user attribute Format Example values<br />
UserShell:<br />
The location of the default shell<br />
for command-line interactions<br />
with the server.<br />
Change:<br />
Not used by <strong>Mac</strong> <strong>OS</strong> X, but<br />
corresponds to part of standard<br />
LDAP schema.<br />
Expire:<br />
Not used by <strong>Mac</strong> <strong>OS</strong> X, but<br />
corresponds to part of standard<br />
LDAP schema.<br />
Path name<br />
Number<br />
Number<br />
AuthenticationAuthority: ASCII text<br />
Describes the user’s<br />
authentication methods, such as<br />
<strong>Open</strong> <strong>Directory</strong>, shadow<br />
password, or crypt password.<br />
Not required for a user with only<br />
a crypt password.<br />
Absence of this attribute<br />
signifies legacy authentication<br />
(crypt with Authentication<br />
Manager, if it is available).<br />
AuthenticationHint:<br />
Text set by the user to be<br />
displayed as a password<br />
reminder.<br />
FirstName:<br />
Used by Address Book and other<br />
applications that use the<br />
Contacts search policy.<br />
UTF-8 text<br />
/bin/tcsh<br />
/bin/sh<br />
None. This value prevents users<br />
with accounts in the directory<br />
domain from accessing the<br />
server remotely through a<br />
command line.<br />
Nonzero length.<br />
Values describe the user’s<br />
authentication methods.<br />
Can be multivalued (for<br />
example, ;<strong>Apple</strong>Password<strong>Server</strong>;<br />
and ;Kerberosv5;).<br />
Each value has the format vers;<br />
tag; data (where vers and data<br />
may be blank).<br />
Crypt password: ;basic;<br />
<strong>Open</strong> <strong>Directory</strong><br />
password: ;<strong>Apple</strong>PasswordServe<br />
r; HexID, server’s public key<br />
IPaddress:port<br />
;Kerberosv5;Kerberos data<br />
Shadow password (local<br />
directory domain only):<br />
 ;ShadowHash;<br />
 ;ShadowHash;<br />
Your guess is as good as mine.<br />
Maximum 255 bytes.<br />
256 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
<strong>Mac</strong> <strong>OS</strong> X user attribute Format Example values<br />
LastName:<br />
Used by Address Book and other<br />
applications that use the<br />
Contacts search policy.<br />
EMailAddress:<br />
An email address that mail<br />
should be forwarded to when a<br />
user has no MailAttribute<br />
defined.<br />
Used by Address Book, Mail, and<br />
other applications that use the<br />
Contacts search policy.<br />
Any legal RFC 822 email address user@example.com<br />
PhoneNumber:<br />
Used by Address Book and other<br />
applications that use the<br />
Contacts search policy.<br />
AddressLine1:<br />
Used by Address Book and other<br />
applications that use the<br />
Contacts search policy.<br />
PostalAddress:<br />
Used by Address Book and other<br />
applications that use the<br />
Contacts search policy.<br />
PostalCode:<br />
Used by Address Book and other<br />
applications that use the<br />
Contacts search policy.<br />
OrganizationName:<br />
Used by Address Book and other<br />
applications that use the<br />
Contacts search policy.<br />
User Data That <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> Uses<br />
The following table describes how your <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> uses data from user records in<br />
directory domains. Consult this table to determine the attributes or data types that<br />
your server’s services expect to find in user records of directory domains.<br />
In the far-left column, “All services” include AFP, SMB, FTP, HTTP, NFS, WebDAV, POP,<br />
IMAP, Workgroup Manager, <strong>Server</strong> Admin, the <strong>Mac</strong> <strong>OS</strong> X login window.<br />
<strong>Server</strong> component <strong>Mac</strong> <strong>OS</strong> X user attribute Dependency<br />
All services RecordName Required for authentication<br />
All services RealName Required for authentication<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 257
<strong>Server</strong> component <strong>Mac</strong> <strong>OS</strong> X user attribute Dependency<br />
All services AuthenticationAuthority Used for Kerberos, password<br />
server, and shadow password<br />
authentication<br />
All services Password Used for basic (crypt password)<br />
or LDAP bind authentication<br />
All services UniqueID Required for authorization (for<br />
example, file permissions and<br />
mail accounts)<br />
All services PrimaryGroupID Required for authorization (for<br />
example, file permissions and<br />
mail accounts)<br />
FTP service<br />
Web service<br />
<strong>Apple</strong> file service<br />
NFS service<br />
<strong>Mac</strong> <strong>OS</strong> X login window<br />
Application and system<br />
preferences<br />
Home<strong>Directory</strong><br />
NFSHome<strong>Directory</strong><br />
Optional<br />
Mail service MailAttribute Required to log in to mail<br />
service on your server<br />
Mail service EMailAddress Optional<br />
Standard Attributes in Group Records<br />
The following table describes the standard attributes found in <strong>Open</strong> <strong>Directory</strong> group<br />
records. Use this information when working in Workgroup Manager’s Inspector pane or<br />
when mapping group attributes with <strong>Directory</strong> Utility.<br />
<strong>Mac</strong> <strong>OS</strong> X group attribute Format Example values<br />
RecordName:<br />
Name associated with a group<br />
ASCII characters A–Z, a–z,<br />
0–9, _<br />
Science<br />
Science_Dept<br />
Science.Teachers<br />
Nonzero length, maximum 255<br />
bytes (85 triple-byte to 255<br />
single-byte characters).<br />
RealName:<br />
Usually the group’s full name<br />
UTF-8 text<br />
Science Department Teachers<br />
Nonzero length, maximum 255<br />
bytes (85 triple-byte to 255<br />
single-byte characters).<br />
PrimaryGroupID:<br />
A unique identifier for the group<br />
Signed 32-bit ASCII string of<br />
digits 0–9<br />
Normally unique among all<br />
group records.<br />
GroupMembership:<br />
ASCII characters A–Z, a–z, bsmith, jdoe<br />
0–9, _,-<br />
A list of short names of user<br />
records that are considered part<br />
of the group<br />
Can be an empty list (normally<br />
for users’ primary group).<br />
258 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
<strong>Mac</strong> <strong>OS</strong> X group attribute Format Example values<br />
Home<strong>Directory</strong>:<br />
The location of an AFP-based<br />
home folder for the group<br />
Structured UTF-8 text<br />
<br />
afp://server/sharept<br />
grouphomedir<br />
<br />
In the following example, the<br />
Science group’s home folder is<br />
K-M/Science, which resides<br />
beneath the Groups share point<br />
directory:<br />
<br />
afp://example.com/<br />
Groups<br />
K-M/Science<br />
<br />
Member:<br />
ASCII characters A–Z, a–z, bsmith, jdoe<br />
0–9, _,-<br />
Same data as GroupMembership<br />
but each is used by different<br />
services of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
HomeLocOwner:<br />
The short name of the user that<br />
owns the group’s home folder<br />
MCXFlags:<br />
If present, MCXSettings is<br />
loaded; if absent, MCXSettings<br />
isn’t loaded; required for a<br />
managed user<br />
MCXSettings:<br />
The preferences for a workgroup<br />
(a managed group)<br />
ASCII characters A–Z, a–z, 0–9,<br />
_,-<br />
UTF-8 XML plist, single value<br />
UTF-8 XML plist, multivalued<br />
Can be an empty list (normally<br />
for users’ primary group).<br />
Standard Attributes in Computer Records<br />
The following table describes the standard attributes found in <strong>Open</strong> <strong>Directory</strong><br />
computer records.<br />
Computer records associate the hardware address of a computer’s primary Ethernet<br />
interface with a name for the computer. The name is part of a computer group record<br />
(much as a user is in a group).<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 259
Use this information when working in Workgroup Manager’s Inspector pane or when<br />
mapping computer record attributes with <strong>Directory</strong> Utility.<br />
<strong>Mac</strong> <strong>OS</strong> X computer attribute Format Example values<br />
RecordName:<br />
Name associated with a<br />
computer.<br />
UTF-8 text i<strong>Mac</strong> 1<br />
Comment:<br />
Any documentation you like.<br />
EnetAddress:<br />
The value of this attribute must<br />
be the Ethernet address (also<br />
known as the MAC address) of<br />
the computer’s built-in Ethernet<br />
interface, even if the computer<br />
connects to the directory using<br />
another network interface such<br />
as AirPort.<br />
UTF-8 text<br />
Colon-separated hex notation;<br />
leading zeroes may be omitted<br />
MCXFlags:<br />
UTF-8 XML plist, single value<br />
Used only in the “guest”<br />
computer record; if present,<br />
MCXSettings is loaded; if absent,<br />
MCXSettings isn’t loaded;<br />
required for a managed<br />
computer.<br />
MCXSettings:<br />
Used only in the “guest”<br />
computer record; a managed<br />
computer’s preferences.<br />
UTF-8 XML plist, multivalued<br />
00:05:02:b7:b5:88<br />
Standard Attributes in Computer Group Records<br />
The following table describes the standard attributes found in <strong>Open</strong> <strong>Directory</strong><br />
computer group records. A computer group record identifies a group of computers<br />
(much as a group record identifies a collection of users).<br />
Use this information when working in Workgroup Manager’s Inspector pane or when<br />
mapping computer group record attributes with <strong>Directory</strong> Utility.<br />
<strong>Mac</strong> <strong>OS</strong> X<br />
computer group attribute Format Example values<br />
RecordName:<br />
UTF-8 text<br />
Lab Computers<br />
Name associated with a<br />
computer group<br />
MCXFlags<br />
UTF-8 XML plist, single value<br />
Nonzero length, maximum 255<br />
bytes (85 triple-byte to 255<br />
single-byte characters)<br />
260 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
<strong>Mac</strong> <strong>OS</strong> X<br />
computer group attribute Format Example values<br />
MCXSettings:<br />
Stores preferences for a<br />
managed computer<br />
UTF-8 XML plist, multivalued<br />
Computers<br />
Group<br />
A list of groups whose members<br />
may log in on the computers in<br />
this computer group<br />
Multivalued list of computer<br />
record names<br />
Multivalued list of short names<br />
of groups<br />
i<strong>Mac</strong> 1, i<strong>Mac</strong> 2<br />
herbivores, omnivores<br />
Standard Attributes in Mount Records<br />
The following table describes the standard attributes found in <strong>Open</strong> <strong>Directory</strong> mount<br />
records. Use this information when working in Workgroup Manager’s Inspector pane or<br />
when mapping mount record attributes with <strong>Directory</strong> Utility.<br />
<strong>Mac</strong> <strong>OS</strong> X<br />
mount attributes Format Example values<br />
RecordName:<br />
Host and path of the sharepoint<br />
UTF-8 text<br />
hostname:/path on server<br />
indigo:/Volumes/home2<br />
VFSLinkDir<br />
Path for the mount on a client<br />
UTF-8 text<br />
/Network/<strong>Server</strong>s<br />
VFSType ASCII text For AFP:<br />
url<br />
For NFS:<br />
nfs<br />
VFSOpts UTF-8 text For AFP (two values):<br />
net<br />
url==afp://<br />
;AUTH=NO%20USER%20<br />
AUTHENT@server/sharepoint/<br />
For NFS:<br />
net<br />
VFSDumpFreq<br />
VFSPassNo<br />
Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data 261
Standard Attributes in Config Records<br />
The following table describes the standard attributes found in the following <strong>Open</strong><br />
<strong>Directory</strong> config records:<br />
 The mcx_cache record always has the RecordName of mcx_cache. It also uses<br />
RealName and DataStamp to determine whether the cache should be updated or<br />
whether the server settings should be ignored. If you want managed clients, you<br />
must have an mcx_cache config record.<br />
 The passwordserver record has the Password<strong>Server</strong>Location attribute.<br />
Use this information when working in Workgroup Manager’s Inspector pane or when<br />
mapping config record attributes with <strong>Directory</strong> Utility.<br />
<strong>Mac</strong> <strong>OS</strong> X config attributes Format Example values<br />
RecordName:<br />
Name associated with a config<br />
ASCII characters A–Z, a–z,<br />
0–9, _,-,.<br />
mcx_cache<br />
passwordserver<br />
Nonzero length, maximum 255<br />
bytes (85 triple-byte to 255<br />
single-byte characters).<br />
Password<strong>Server</strong>Location:<br />
Identifies the host of the<br />
password server that’s<br />
associated with the directory<br />
domain<br />
IP address or host name 192.168.1.90<br />
RealName<br />
DataStamp<br />
For the mcx_cache config<br />
record, RealName is a GUID.<br />
For the mcx_cache config<br />
record, DataStamp is a GUID.<br />
262 Appendix <strong>Mac</strong> <strong>OS</strong> X <strong>Directory</strong> Data
Glossary<br />
Glossary<br />
Active <strong>Directory</strong> The directory and authentication service of Microsoft Windows 2000<br />
<strong>Server</strong>, Windows <strong>Server</strong> 2003, and Windows <strong>Server</strong> 2003 R2.<br />
administrator A user with server or directory domain administration privileges.<br />
Administrators are always members of the predefined “admin” group.<br />
administrator computer A <strong>Mac</strong> <strong>OS</strong> X computer onto which you’ve installed the server<br />
administration applications from the <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> Admin CD.<br />
AFP <strong>Apple</strong> Filing Protocol. A client/server protocol used by <strong>Apple</strong> file service to share<br />
files and network services. AFP uses TCP/IP and other protocols to support<br />
communication between computers on a network.<br />
attribute A named data item containing a specific type of information and belonging<br />
to an entry (record or object) in a directory domain. The actual data that an attribute<br />
contains is its value.<br />
authentication The process of proving a user’s identity, typically by validating a user<br />
name and password. Usually authentication occurs before an authorization process<br />
determines the user’s level of access to a resource. For example, file service authorizes<br />
full access to folders and files that an authenticated user owns.<br />
authentication authority attribute A value that identifies the password validation<br />
scheme specified for a user and provides additional information as required.<br />
authorization The process by which a service determines whether it should grant a<br />
user access to a resource and how much access the service should allow the user to<br />
have. Usually authorization occurs after an authentication process proves the user’s<br />
identity. For example, file service authorizes full access to folders and files that an<br />
authenticated user owns.<br />
binding A connection between a computer and a directory domain for the purpose of<br />
getting identification, authorization, and other administrative data. (verb) Also, the<br />
process of making such a connection. See also trusted binding.<br />
263
BSD Berkeley Software Distribution. A version of UNIX on which <strong>Mac</strong> <strong>OS</strong> X software is<br />
based.<br />
child A computer that gets configuration information from the shared directory<br />
domain of a parent.<br />
CIFS Common Internet File System. See SMB.<br />
class See object class.<br />
computer account A computer account stores data that allows <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> to<br />
identify and manage an individual computer. You create a computer account for each<br />
computer that you intend to add to a computer group.<br />
computer list A set of computers that all receive the managed preference settings<br />
defined for the list, and that are all available to a particular set of users and groups. A<br />
computer can be a member of only one computer list. Computer lists are created in<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> version 10.4 or earlier.<br />
cracker A malicious user who tries to gain unauthorized access to a computer system<br />
in order to disrupt computers and networks or steal information. Compare to hacker.<br />
crypt password A type of password that’s stored as a hash (using the standard UNIX<br />
encryption algorithm) directly in a user record.<br />
DHCP Dynamic Host Configuration Protocol. A protocol used to dynamically distribute<br />
IP addresses to client computers. Each time a client computer starts up, the protocol<br />
looks for a DHCP server and then requests an IP address from the DHCP server it finds.<br />
The DHCP server checks for an available IP address and sends it to the client computer<br />
along with a lease period—the length of time the client computer may use the<br />
address.<br />
directory domain A specialized database that stores authoritative information about<br />
users and network resources; the information is needed by system software and<br />
applications. The database is optimized to handle many requests for information and to<br />
find and retrieve information quickly. Also called a directory node or simply a directory.<br />
directory domain hierarchy A way of organizing local and shared directory domains. A<br />
hierarchy has an inverted tree structure, with a root domain at the top and local<br />
domains at the bottom.<br />
directory node See directory domain.<br />
directory services Services that provide system software and applications with<br />
uniform access to directory domains and other sources of information about users and<br />
resources.<br />
264 Glossary
distinguished name Specifies an entry (object) in an LDAP directory. Represented as a<br />
sequence of directory entries separated by commas, starting with the entry itself and<br />
followed by each entry that contains the previous entry in the sequence. Example:<br />
“cn=users, dc=example, dc=com.”<br />
entry An article posted on a blog. Readers can add comments to the entry, but the<br />
content associated with the entry can be changed only by the blog owner. In an LDAP<br />
directory, an entry is a collection of attributes (data items) that has a unique<br />
distinguished name. See also distinguished name.<br />
FTP File Transfer Protocol. A protocol that allows computers to transfer files over a<br />
network. FTP clients using any operating system that supports FTP can connect to a file<br />
server and download files, depending on their access privileges. Most Internet browsers<br />
and a number of freeware applications can be used to access an FTP server.<br />
group A collection of users who have similar needs. Groups simplify the administration<br />
of shared resources.<br />
group folder A folder that organizes documents and applications of special interest to<br />
group members and allows group members to pass information among themselves.<br />
guest user A user who can log in to your server without a user name or password.<br />
hacker An individual who enjoys programming, and explores ways to program new<br />
features and expand the capabilities of a computer system. See also cracker.<br />
hash (noun) A scrambled, or encrypted, form of a password or other text.<br />
IP Internet Protocol. Also known as IPv4. A method used with Transmission Control<br />
Protocol (TCP) to send data between computers over a local network or the Internet. IP<br />
delivers data packets and TCP keeps track of data packets.<br />
IP address A unique numeric address that identifies a computer on the Internet.<br />
KDC Kerberos Key Distribution Center. A trusted server that issues Kerberos tickets.<br />
Kerberos A secure network authentication system. Kerberos uses tickets, which are<br />
issued for a specific user, service, and period of time. After a user is authenticated, it’s<br />
possible to access additional services without retyping a password (called single signon)<br />
for services that have been configured to take Kerberos tickets. <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
uses Kerberos v5.<br />
Kerberos realm The authentication domain comprising the users and services that are<br />
registered with the same Kerberos server. The registered users and services trust the<br />
Kerberos server to verify each other’s identities.<br />
LDAP Lightweight <strong>Directory</strong> Access Protocol. A standard client-server protocol for<br />
accessing a directory domain.<br />
Glossary 265
local domain A directory domain that can be accessed only by the computer it resides<br />
on.<br />
local hostname A name that designates a computer on a local subnet. It can be used<br />
without a global DNS system to resolve names to IP addresses. It consists of lowercase<br />
letters, numbers, or hyphens (except as the last characters), and ends with “.local” (For<br />
example, bills-computer.local). Although the default name is derived from the<br />
computer name, a user can specify this name in the Sharing pane of System<br />
Preferences. It can be changed easily, and can be used anywhere a DNS name or fully<br />
qualified domain name is used. It can only resolve on the same subnet as the computer<br />
using it.<br />
long name The long form of a user or group name. See also user name.<br />
<strong>Mac</strong> <strong>OS</strong> X The latest version of the <strong>Apple</strong> operating system. <strong>Mac</strong> <strong>OS</strong> X combines the<br />
reliability of UNIX with the ease of use of <strong>Mac</strong>intosh.<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> An industrial-strength server platform that supports <strong>Mac</strong>, Windows,<br />
UNIX, and Linux clients out of the box and provides a suite of scalable workgroup and<br />
network services plus advanced remote management tools.<br />
managed client A user, group, or computer whose access privileges and/or<br />
preferences are under administrative control.<br />
managed preferences System or application preferences that are under administrative<br />
control. Workgroup Manager allows administrators to control settings for certain<br />
system preferences for <strong>Mac</strong> <strong>OS</strong> X managed clients.<br />
multicast DNS A protocol developed by <strong>Apple</strong> for automatic discovery of computers,<br />
devices, and services on IP networks. Called Bonjour (previously Rendezvous) by <strong>Apple</strong>,<br />
this proposed Internet standard protocol is sometimes referred to as ZeroConf or<br />
multicast DNS. For more information, visit www.apple.com or www.zeroconf.org. To see<br />
how this protocol is used in <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>, see local hostname.<br />
NetInfo An older <strong>Apple</strong> protocol for accessing a directory domain.<br />
object class A set of rules that define similar objects in a directory domain by<br />
specifying attributes that each object must have and other attributes that each object<br />
may have.<br />
<strong>Open</strong> <strong>Directory</strong> The <strong>Apple</strong> directory services architecture, which can access<br />
authoritative information about users and network resources from directory domains<br />
that use LDAP, Active <strong>Directory</strong> protocols, or BSD configuration files, and network<br />
services.<br />
<strong>Open</strong> <strong>Directory</strong> master A server that provides LDAP directory service, Kerberos<br />
authentication service, and <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong>.<br />
266 Glossary
<strong>Open</strong> <strong>Directory</strong> password A password that’s stored in secure databases on the server<br />
and can be authenticated using <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> or Kerberos (if<br />
Kerberos is available).<br />
<strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> An authentication service that validates passwords<br />
using a variety of conventional authentication methods required by the different<br />
services of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>. The authentication methods include APOP, CRAM-MD5,<br />
DHX, LAN Manager, NTLMv1, NTLMv2, and WebDAV-Digest.<br />
open source A term for the cooperative development of software by the Internet<br />
community. The basic principle is to involve as many people as possible in writing and<br />
debugging code by publishing the source code and encouraging the formation of a<br />
large community of developers who will submit modifications and enhancements.<br />
owner The owner of an item can change access permissions to the item. The owner<br />
may also change the group entry to any group the owner is a member of. By default,<br />
the owner has Read & Write permissions.<br />
parent A computer whose shared directory domain provides configuration<br />
information to another computer.<br />
password An alphanumeric string used to authenticate the identity of a user or to<br />
authorize access to files or services.<br />
Password <strong>Server</strong> See <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong>.<br />
primary group A user’s default group. The file system uses the ID of the primary group<br />
when a user accesses a file he or she doesn’t own.<br />
primary group ID A unique number that identifies a primary group.<br />
principal, Kerberos The name and other identifying information of a client or service<br />
that Kerberos can authenticate. A user principal is usually a user’s name or user’s name<br />
and Kerberos realm. A service’s principal is usually the service name, server’s fullyqualified<br />
DNS name, and Kerberos realm.<br />
protocol A set of rules that determines how data is sent back and forth between two<br />
applications.<br />
schema The collection of attributes and record types or classes that provide a<br />
blueprint for the information in a directory domain.<br />
search base A distinguished name that identifies where to start searching for<br />
information in an LDAP directory’s hierarchy of entries.<br />
search path See search policy.<br />
Glossary 267
search policy A list of directory domains searched by a <strong>Mac</strong> <strong>OS</strong> X computer when it<br />
needs configuration information; also, the order in which domains are searched.<br />
Sometimes called a search path.<br />
shadow password A password that’s stored in a secure file on the server and can be<br />
authenticated using a variety of conventional authentication methods required by the<br />
different services of <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong>. The authentication methods include APOP, CRAM-<br />
MD5, DHX, LAN Manager, NTLMv1, NTLMv2, and WebDAV-Digest.<br />
share point A folder, hard disk (or hard disk partition), or optical disc that’s accessible<br />
over the network. A share point is the point of access at the top level of a group of<br />
shared items. Share points can be shared using AFP, SMB, NFS (an export), or FTP.<br />
short name An abbreviated name for a user. The short name is used by <strong>Mac</strong> <strong>OS</strong> X for<br />
home folders, authentication, and email addresses.<br />
single sign-on An authentication strategy that relieves users from entering a name<br />
and password separately for every network service. <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> uses Kerberos to<br />
enable single sign-on.<br />
SLP DA Service Location Protocol <strong>Directory</strong> Agent. A protocol that registers services<br />
available on a network and gives users easy access to them. When a service is added to<br />
the network, the service uses SLP to register itself on the network. SLP DA uses a<br />
centralized repository for registered network services.<br />
SMB <strong>Server</strong> Message Block. A protocol that allows client computers to access files and<br />
network services. It can be used over TCP/IP, the Internet, and other network protocols.<br />
SMB services use SMB to provide access to servers, printers, and other network<br />
resources.<br />
SSL Secure Sockets Layer. An Internet protocol that allows you to send encrypted,<br />
authenticated information across the Internet. More recent versions of SSL are known<br />
as TLS (Transport Level Security).<br />
standalone server A server that provides services on a network but doesn’t get<br />
directory services from another server or provide directory services to other computers.<br />
ticket, Kerberos A temporary credential that proves a Kerberos client’s identity to a<br />
service.<br />
ticket-granting ticket A special Kerberos ticket that enables a client to obtain tickets<br />
for services within the same realm. A client gets a ticket-granting ticket by proving<br />
identity, for example by entering a valid name and password during login.<br />
trusted binding A mutually authenticated connection between a computer and a<br />
directory domain. The computer provides credentials to prove its identity, and the<br />
directory domain provides credentials to prove its authenticity.<br />
268 Glossary
user name The long name for a user, sometimes referred to as the user’s real name.<br />
See also short name.<br />
WebDAV Web-based Distributed Authoring and Versioning. A live authoring<br />
environment that allows client users to check out webpages, make changes, and then<br />
check the pages back in to the site while the site is running.<br />
WebDAV realm A region of a website, usually a folder or directory, that’s defined to<br />
provide access for WebDAV users and groups.<br />
Glossary 269
270 Glossary
Index<br />
Index<br />
A<br />
access<br />
ACLs 40, 73, 74, 175<br />
Active <strong>Directory</strong> domains 159, 169<br />
administrator 74, 175<br />
attributes 176<br />
DACs 180<br />
directory domain uses 24<br />
directory service 132, 133<br />
file 24<br />
folder 24<br />
group 174<br />
login window 174<br />
record 176<br />
replicas 88<br />
server 29, 174<br />
SSH 174<br />
user 157, 173, 174, 201<br />
See also LDAP; permissions<br />
access control entries. See ACEs<br />
access control lists. See ACLs<br />
accounts<br />
administrator 84, 166<br />
root 123, 124, 201<br />
See also group accounts; mobile accounts; user<br />
accounts; Workgroup Manager<br />
ACEs (access control entries) 74<br />
ACL attribute 235<br />
ACL object class 216<br />
ACLs (access control lists) 40, 73, 74, 175<br />
Active <strong>Directory</strong><br />
accessing 159<br />
administrator groups 166<br />
advanced settings 132, 156<br />
authentication 167<br />
binding to 160, 168<br />
client connections 121<br />
cross-domain authorization 69<br />
definition 25<br />
disabling service 132<br />
editing records 168<br />
enabling service 132<br />
group IDs 164, 165<br />
home folders 157, 162<br />
Kerberos conflicts 70<br />
LDAP access 169<br />
mobile accounts 158, 161<br />
<strong>Open</strong> <strong>Directory</strong> setup 60<br />
preferred designation 166<br />
server setup 95<br />
troubleshooting 200, 203<br />
unbinding from server 168<br />
UNIX shell attribute 163<br />
user IDs 163<br />
See also mappings<br />
Address Book 38, 128, 134<br />
addresses. See Ethernet ID; IP addresses; NAT<br />
administrator<br />
access control 74, 175<br />
accounts for 84, 166<br />
authentication authority 86, 88, 92, 115, 116<br />
directory services 19<br />
Kerberos 47, 97<br />
limits on 219<br />
passwords for 45, 111, 112, 201, 206<br />
planning domains 36<br />
privileges of 74, 75<br />
search policies 36<br />
APOP (authenticated POP) 52, 56<br />
archiving <strong>Open</strong> <strong>Directory</strong> master 194, 195<br />
attributes<br />
access control 176<br />
ACL 235<br />
Active <strong>Directory</strong> 165<br />
adding 70, 148<br />
authentication 44, 118, 181, 219, 232, 233<br />
automount 237<br />
computer 230, 259<br />
computer group 260<br />
computer list 230<br />
configuration 154, 231, 262<br />
contact information 221<br />
directory 157<br />
directory services 148<br />
group 224<br />
importing 183<br />
271
introduction 25<br />
LDAP 147<br />
location 233<br />
machine 226<br />
mount 227, 261<br />
neighborhood 235<br />
passwords 231<br />
printer 219, 229<br />
replication 232<br />
resource 236<br />
schema 236<br />
service 231, 234<br />
service URL 231<br />
standard 253<br />
TTL 217<br />
UNIX shell 163<br />
user 217, 233, 253, 257<br />
XML plist 231<br />
See also mappings<br />
augment object class 216<br />
authentication<br />
Active <strong>Directory</strong> 167<br />
administrator 86, 88, 92, 115, 116<br />
attributes 44, 118, 181, 219, 232, 233<br />
bind 56, 116, 137<br />
cached 41<br />
clients 48, 51<br />
credential-based 41, 48<br />
definition 40<br />
directory domains 24, 61<br />
file services 53<br />
LDAP 56, 116, 137, 153<br />
methods 41, 42, 52, 54, 55, 56, 94<br />
monitoring of 178<br />
<strong>Open</strong> <strong>Directory</strong> master 31, 98<br />
overview 11, 21, 39, 105<br />
replication 62<br />
SASL 12, 52<br />
search policies 38, 128<br />
server 49, 73<br />
troubleshooting 199, 201, 202, 203, 205, 206<br />
user 40, 45, 46<br />
See also Kerberos; passwords<br />
authentication authority attributes 44, 118, 181, 233<br />
authentication authority object class 215<br />
Authentication Manager 32, 42, 118<br />
authorization 40, 69, 73, 74, 75, 175<br />
See also authentication<br />
automount attribute 237<br />
automount object classes 216<br />
automount share points 24<br />
Auto<strong>Server</strong>Setup record type 252<br />
B<br />
backup domain controller. See BDC<br />
basic authentication. See crypt passwords<br />
BDC (backup domain controller) 32, 85, 91, 190<br />
Berkeley DB 11, 61<br />
Berkeley Software Distribution. See BSD<br />
binding<br />
Active <strong>Directory</strong> 168<br />
LDAP authentication 56, 116, 137, 151<br />
<strong>Open</strong> <strong>Directory</strong> server 184<br />
rebind-try delay time 151<br />
See also trusted binding<br />
boot process. See startup<br />
BSD (Berkeley System Distribution) files 25, 171<br />
C<br />
cached authentication 41<br />
cascading replication 61, 64, 65, 91<br />
certificates 69, 187, 188<br />
client computers<br />
BSD files 25, 171<br />
connections 61, 119, 121, 122, 123<br />
failover process 92<br />
mount records 126, 127, 128<br />
NIS 25, 170<br />
<strong>Open</strong> <strong>Directory</strong> support 61<br />
search policies 35, 128, 129, 130, 131<br />
setup 120, 121, 125, 126<br />
share points 24<br />
See also directory services<br />
clients, authentication of 48, 51<br />
See also client computers; group accounts; users<br />
command-line tools<br />
deleting users or computers 181<br />
directory configuration 157<br />
overview 78<br />
passwords 112, 115<br />
restoring servers 195, 196<br />
short name changes 182<br />
SSH 174<br />
computer attributes 230, 259<br />
computer group attributes 260<br />
computer group object class 213<br />
computer list attributes 230<br />
computer list object class 212<br />
computer lists, mappings 244, 245, 248<br />
computer name 86, 92, 116, 149<br />
computer object class 211<br />
computers<br />
deleting 181<br />
mappings 243<br />
replica connections 90<br />
search policies 37, 38<br />
time synchronization 97<br />
See also client computers<br />
Config record type 154, 245, 246<br />
configuration<br />
272 Index
attributes for 262<br />
BSD files 171<br />
client computers 120, 121, 262<br />
command-line tools 157<br />
connection 93, 94, 95, 121, 122, 123<br />
cross-domain authorization 69<br />
directory domain overview 58<br />
directory services 125, 126<br />
failover 92<br />
Kerberos 97, 98, 99, 102<br />
LDAP 135, 136, 138, 140, 141, 143<br />
local directory domain 81<br />
<strong>Open</strong> <strong>Directory</strong> master 83, 85<br />
<strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> 83<br />
<strong>Open</strong> <strong>Directory</strong> replica 88, 90, 91<br />
overview 79, 80<br />
planning for 60<br />
replica sets 63<br />
server 94, 95, 252<br />
trusted binding 149<br />
UNIX files 21, 23, 25<br />
Windows domain 85, 86, 87<br />
configuration attributes 231, 262<br />
configuration object classes 212<br />
contact information attributes 221<br />
contacts, search policies 38, 128<br />
container object class 209<br />
controllers, BDC 32, 85, 91, 190<br />
See also PDC<br />
CRAM-MD5 authentication 52<br />
credential-based authentication 41, 48<br />
See also Kerberos<br />
cross-domain authorization 69<br />
crypt passwords<br />
changing to 110<br />
definition 42<br />
encryption 44<br />
security issues 44<br />
user account migration 117<br />
Windows limitations 31, 42<br />
D<br />
DACs (<strong>Directory</strong> Access Controls) 180<br />
databases<br />
Berkeley DB 11, 61<br />
LDAP 186<br />
<strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong> 54, 56<br />
delay rebinding options, LDAP 151<br />
denial of service attack. See DoS attack<br />
DHCP (Dynamic Host Configuration Protocol) service<br />
LDAP 37, 129, 134<br />
mobile accounts 132<br />
option 95 37, 184<br />
security 131<br />
DHX authentication 42, 53<br />
Digest-MD5 authentication 53<br />
directories. See directory services; domains, directory;<br />
folders<br />
<strong>Directory</strong> Access Controls. See DACs<br />
directory services<br />
access 132, 133<br />
administrators for 19<br />
advanced settings 125, 132<br />
attributes 148<br />
benefits of 19<br />
connection problems 201<br />
Kerberos readiness 98<br />
mapping of 148, 154<br />
organization of 20<br />
planning of 36<br />
setup 125, 126<br />
See also Active <strong>Directory</strong>; domains, directory;<br />
<strong>Open</strong> <strong>Directory</strong><br />
<strong>Directory</strong> Utility 69, 77, 119, 125, 126<br />
distinguished name (DN) 27, 138<br />
DNS (Domain Name System) service<br />
attributes 233, 234<br />
Kerberos 83, 97, 98, 200<br />
<strong>Open</strong> <strong>Directory</strong> setup 83, 98<br />
Windows users 86<br />
documentation 15, 16, 17<br />
Domain Name System. See DNS<br />
domains, directory<br />
authentication 24, 61<br />
binding of 184<br />
identifying servers 62<br />
integrating 69<br />
NetInfo 32, 110, 118<br />
NIS 25, 170<br />
non-<strong>Apple</strong> 30<br />
organization of 20, 24, 25<br />
planning of 36, 57, 58, 80<br />
ports 73<br />
replication 59<br />
schemas 26, 70, 158, 207, 208, 209<br />
search policies 128, 129, 130, 131<br />
storage capacity of 61<br />
See also LDAP; local directory domains; <strong>Open</strong><br />
<strong>Directory</strong>; Windows domain<br />
DoS attack (denial of service) 45, 187<br />
dsconfigad tool 157<br />
dsconfigldap tool 157<br />
Dynamic Host Configuration Protocol. See DHCP<br />
E<br />
encryption 44, 53, 157<br />
entries, object class 25, 27<br />
Ethernet ID 205<br />
exporting users 117<br />
See also importing<br />
Index 273
F<br />
failover<br />
BDC 32, 85, 91, 190<br />
load balancing 65<br />
PDC 32<br />
setup 92<br />
files<br />
access control 24<br />
BSD 25, 171<br />
property list 200<br />
UNIX configuration 21, 23, 25<br />
file services<br />
authentication 53<br />
NFS 126, 127, 128<br />
share points 24, 126<br />
SMB 30, 53<br />
finding users and groups 28, 29<br />
See also searching<br />
firewalls, limitations of 48<br />
firewall service 73<br />
folders, access control 24<br />
See also files; home folders<br />
full name. See long name<br />
G<br />
GID (group ID) 69, 157, 164, 165<br />
globally unique identifier. See GUID<br />
global password policy 111<br />
group accounts<br />
as administrators 166<br />
GID mappings 164<br />
group ID 157, 165<br />
importing 183<br />
presets 213, 248, 249<br />
See also groups<br />
group attributes 224, 258<br />
group auxiliary object class 210<br />
group ID. See GID<br />
groups<br />
access control 174<br />
finding 28, 29<br />
information storage for 24<br />
joining Kerberos realm 100<br />
mappings 164, 241, 242, 248, 249<br />
tiered administration 75<br />
GUID (globally unique identifier) 183<br />
H<br />
hash, password 41, 54, 55<br />
help, using 14<br />
home folders<br />
Active <strong>Directory</strong> 157, 162<br />
directory domain uses 24<br />
group attributes 224<br />
local user 162<br />
network 162<br />
user attributes 217, 220, 223<br />
I<br />
idle timeout, LDAP connection 152<br />
importing<br />
attributes 183<br />
groups 183<br />
records 183<br />
users 117, 183<br />
Inspector 179, 180, 181<br />
IP addresses 83, 121<br />
IP firewall service 73<br />
K<br />
Kerberos<br />
administrator 47, 97<br />
attributes 232<br />
authentication process 51<br />
cross-domain authorization 69<br />
deleting identities 181<br />
directory domain conflicts 70<br />
DNS 83, 97, 98, 200<br />
enabling 111, 204<br />
features 11, 41, 46, 47, 48, 49, 50<br />
joining 100, 102<br />
LDAP 70<br />
passwords 46<br />
principals 51<br />
realms 51, 102, 205<br />
replication of 62<br />
security 48, 49, 194<br />
setup 97, 98, 99, 102<br />
troubleshooting 199, 203<br />
users 46, 99<br />
L<br />
LAN Manager authentication 42, 53<br />
LDAP (Lightweight <strong>Directory</strong> Access Protocol)<br />
connection settings 152<br />
timeouts 152<br />
LDAP (Lightweight <strong>Directory</strong> Access Protocol)<br />
service<br />
Active <strong>Directory</strong> 169<br />
administrator requirement 86<br />
advanced settings 133<br />
authentication 56, 116, 137, 151, 153<br />
command-line tools 157, 182<br />
configuration 90, 135, 136, 138, 140, 141, 143<br />
connection settings 93, 150, 151<br />
database location 186<br />
definition 25<br />
DHCP 37, 129, 134<br />
direct access to 129<br />
disabling 133, 134<br />
274 Index
enabling 133, 134<br />
Kerberos 70<br />
<strong>Mac</strong> <strong>OS</strong> X 155<br />
mail 134<br />
NetInfo, migrating from 32, 118<br />
<strong>Open</strong> <strong>Directory</strong> 11, 208, 209<br />
read-only access 152<br />
replication 62<br />
schemas 208, 209<br />
searching 27, 84, 146, 186, 187, 203<br />
search policies 37<br />
security 40, 106, 145, 153, 184, 186, 187, 188<br />
server referrals 152<br />
structure of 27<br />
timeouts 150, 151, 187<br />
troubleshooting 201, 203<br />
user privileges 75, 152, 155<br />
See also attributes; mappings; object classes;<br />
trusted binding<br />
ldapmodrdn tool 182<br />
ldapsearch tool 155<br />
LDAPv2 access 152<br />
LDAPv3 access 75, 90, 133, 136, 169<br />
Leopard server. See <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
load balancing 60, 65<br />
local directory domains<br />
introduction 26, 28<br />
mount records 126, 127, 128<br />
password types 40, 41<br />
planning for 58<br />
search policy 33, 35, 37, 131<br />
setup 81<br />
Windows users 31<br />
local home folders 162<br />
location attributes 233<br />
location object class 215<br />
Locations record type 253<br />
login<br />
access control 174<br />
directory domains 24, 62<br />
failed attempts 178<br />
mobile accounts 67<br />
passwords 42<br />
picture for user 219<br />
speeding up 63<br />
troubleshooting 202<br />
user instructions 85<br />
Windows setup authority 86<br />
logs, <strong>Open</strong> <strong>Directory</strong> 72, 178<br />
long name 224, 232<br />
See also short name; user name<br />
M<br />
machine attributes 226<br />
machine auxiliary object class 210<br />
<strong>Mac</strong> <strong>OS</strong> X<br />
BSD files 171<br />
<strong>Open</strong> <strong>Directory</strong> passwords 41<br />
populating directories 155<br />
read-only LDAP access 155<br />
troubleshooting login 202<br />
<strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong><br />
adding connections 121<br />
authentications supported 32, 46, 53, 94<br />
BDC 32<br />
BSD files 171<br />
failover issues 92<br />
importing records 183<br />
password migration 117<br />
restoring <strong>Open</strong> <strong>Directory</strong> master 195<br />
trusted binding 184<br />
upgrading 67, 118<br />
mail service 24, 52, 134, 218<br />
managed network views 25<br />
mappings<br />
Active <strong>Directory</strong> 158, 163, 164, 165<br />
Auto<strong>Server</strong>Setup record type 252<br />
computer lists 244, 245, 248<br />
computers 243<br />
Config record type 245, 246<br />
directory services 148, 154<br />
groups 164, 241, 242, 248, 249<br />
LDAP 136, 138, 146, 148, 154<br />
Locations record type 253<br />
mounts 242, 243<br />
overview 207<br />
People record type 246, 247<br />
printers 251<br />
RFC 2307 140, 154, 164<br />
users 163, 238, 249, 250<br />
media access control. See Ethernet ID<br />
migration<br />
NetInfo to LDAP 32, 118<br />
password 117<br />
mobile accounts<br />
Active <strong>Directory</strong> 158, 161<br />
LDAP 132<br />
login 67<br />
password policies 45, 112<br />
search policies 37, 38<br />
VPN service 67<br />
mount attributes 227, 261<br />
mounting, automounting 24, 216, 237<br />
mount object class 211<br />
Mount record type 126, 127, 128, 242, 243, 261<br />
MS-CHAPv2 authentication 53, 94<br />
N<br />
naming conventions<br />
computer name 86, 92, 116, 149<br />
Index 275
long name 224, 232<br />
short name 182<br />
user name 84<br />
NAT (Network Address Translation) 66<br />
neighborhood attributes 235<br />
neighborhood object class 215<br />
NeST tool 115<br />
NetBI<strong>OS</strong> name 92<br />
NetInfo domains 32, 110, 118<br />
Network Address Translation. See NAT<br />
Network File System. See NFS<br />
network home folders 162<br />
Network Information Service. See NIS<br />
networks<br />
client connections 61, 119, 121, 122, 123<br />
configuration 93, 94, 95, 121, 122, 123<br />
Kerberos realm 205<br />
LDAP connections 93, 150, 151, 152<br />
managed views 25<br />
private 66<br />
public 66<br />
replica connections 90<br />
troubleshooting 201<br />
network services<br />
IP addresses 83, 121<br />
IP firewall service 73<br />
NAT 66<br />
VPN 53, 67, 202<br />
See also DHCP; DNS<br />
network time protocol. See NTP<br />
NFS (Network File System) 126, 127, 128<br />
NIS (Network Information Service) 25, 170<br />
NTLM authentication 42, 53, 94<br />
NTP (network time protocol) 203<br />
O<br />
object classes<br />
ACL 216<br />
adding to schemas 70<br />
augment 216<br />
authentication authority 215<br />
automount 216<br />
computer 211, 212, 213<br />
computer group 213<br />
computer list 212<br />
configuration 212, 215<br />
container 209<br />
group 210, 213<br />
introduction 25<br />
location 215<br />
machine auxiliary 210<br />
mount 211<br />
neighborhood 215<br />
overview 209<br />
printer 211<br />
resource 216<br />
service 215<br />
TTL 209<br />
user 209, 214<br />
See also attributes<br />
offline attacks 43<br />
open/close timeout, LDAP connection 150<br />
<strong>Open</strong> <strong>Directory</strong><br />
access tools 25, 173, 174, 175, 176<br />
and BDC 32, 91<br />
binding policy 184<br />
client computer support 61<br />
connection setup 93, 94, 95, 121<br />
DNS setup 83, 98<br />
editing data 179, 180, 181, 182<br />
functions of 20<br />
history of 21, 23<br />
and Inspector 179, 180, 181<br />
and Kerberos 11, 41, 70<br />
and LDAP 11, 208, 209<br />
maintaining 173<br />
management tools 75, 76, 77, 78<br />
monitoring of 177, 178<br />
options settings 183, 184<br />
overview 11, 19<br />
and PDC 31, 85, 86, 87<br />
performance improvement 72<br />
remote servers 81<br />
replication of 189<br />
security policy 184<br />
setup 60, 79, 80<br />
SMB services 30<br />
standalone service 81<br />
status checking 177, 178<br />
turning on 81<br />
uses for 24<br />
viewing data 179<br />
and Workgroup Manager 20<br />
See also Active <strong>Directory</strong>; domains, directory;<br />
mappings<br />
<strong>Open</strong> <strong>Directory</strong> master<br />
archiving 194, 195<br />
authentication 31, 98<br />
binding 184<br />
definition 62<br />
and DNS 83, 98<br />
failover 92<br />
introduction 26<br />
passwords 107<br />
and replicas 61, 64, 66, 67, 83, 189, 190, 193<br />
restoring 195<br />
security policy 184<br />
setup 83, 85<br />
status checking 177<br />
troubleshooting 199, 200<br />
upgrading 67<br />
276 Index
<strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong><br />
archiving 194<br />
authentication 31, 41, 52<br />
database 54, 56<br />
deleting slots 181<br />
password policy 45<br />
replication of 62<br />
security 73<br />
setup 83<br />
troubleshooting 202<br />
<strong>Open</strong> <strong>Directory</strong> replica<br />
access control 88<br />
attributes 232<br />
authentication 62<br />
and BDC 32<br />
changing to relay 190<br />
decommissioning of 193<br />
failover 92<br />
hosting 89<br />
introduction 12, 26<br />
and master 61, 64, 66, 67, 83, 189, 190, 193<br />
NAT 66<br />
passwords 62, 63, 107<br />
promotion of 190<br />
replica sets 63<br />
setup 88, 90, 91<br />
synchronization of 190<br />
troubleshooting 199, 200<br />
updating 72<br />
<strong>Open</strong>LDAP. See <strong>Open</strong> <strong>Directory</strong><br />
open source modules 11<br />
See also Kerberos; <strong>Open</strong> <strong>Directory</strong><br />
option 95, DHCP 37, 184<br />
P<br />
PAC (Privilege Attribute Certificate) 69<br />
packets, data 157<br />
passwords<br />
administrator 45, 111, 112, 201, 206<br />
attributes 231<br />
best practices 43<br />
creating 106, 117<br />
exporting 117<br />
hash 41, 54, 55<br />
importing 117<br />
LDAP 153<br />
migration of 117<br />
<strong>Open</strong> <strong>Directory</strong> 41, 42, 43, 44, 52, 92, 108, 114<br />
policies 39, 45, 111, 112, 220<br />
on replicas 63<br />
resetting 54, 107, 206<br />
root account 124<br />
vs. single sign-on 46<br />
troubleshooting 201, 202, 205<br />
types 40, 41, 42, 108, 110<br />
user accounts 201<br />
Windows domain 31, 42, 44<br />
See also crypt passwords; <strong>Open</strong> <strong>Directory</strong><br />
Password <strong>Server</strong>; shadow passwords<br />
Password <strong>Server</strong>. See <strong>Open</strong> <strong>Directory</strong> Password<br />
<strong>Server</strong><br />
PDC (primary domain controller)<br />
failover 32<br />
<strong>Open</strong> <strong>Directory</strong> as 31, 85, 86, 87<br />
replication scheduling 189<br />
server setup 94<br />
People record type 246, 247<br />
permissions<br />
access 175<br />
administrator 75<br />
record 176<br />
tiered administration 75<br />
user 75, 152, 155<br />
picture, user login 219<br />
plug-ins 11, 157<br />
portable computers, search policies 37, 38<br />
See also mobile accounts<br />
ports<br />
directory domain server 73<br />
replication 193<br />
service attribute 234<br />
preset computer group object class 213<br />
preset computer list object class 212<br />
PresetComputerLists record type 248<br />
preset computer object class 213<br />
preset group object class 213<br />
PresetGroups record type 248, 249<br />
preset user attribute 233<br />
preset user object class 214<br />
PresetUsers record type 249, 250<br />
primary domain controller. See PDC<br />
principals, Kerberos 51<br />
printer attributes 219, 229<br />
printer object class 211<br />
Printers record type 251<br />
private network 53, 66, 67, 202<br />
Privilege Attribute Certificate. See PAC<br />
privileges, administrator 75<br />
See also permissions<br />
problems. See troubleshooting<br />
property list files 200<br />
protocols<br />
NTP 203<br />
SMB 30<br />
See also DHCP; LDAP<br />
pseudo-master server 69<br />
public network 66<br />
pwpolicy tool 112<br />
Index 277
Q<br />
query timeout, LDAP 151<br />
R<br />
RAID (Redundant Array of Independent Disks) 73<br />
RDN (relative distinguished name) 27<br />
read-only access, LDAP 152, 155<br />
realms. See Kerberos<br />
RealName 147<br />
real name. See long name<br />
rebind-try delay time, LDAP 151<br />
records<br />
access control 176<br />
adding to schemas 70<br />
DACs settings 180<br />
deleting 181<br />
directory domain capacity 61<br />
editing Active <strong>Directory</strong> 168<br />
enabling for Kerberos 204<br />
importing 183<br />
introduction 25<br />
mapping to directory services 148, 154<br />
permissions 176<br />
standard types 253<br />
See also attributes; mappings<br />
Redundant Array of Independent Disks. See RAID<br />
referrals, server 152<br />
relative distinguished name. See RDN<br />
relays 91, 190, 200<br />
remote servers 81, 126, 174<br />
replication<br />
cascading 61, 64, 65, 91<br />
directory domains 59<br />
management of 189, 190, 193<br />
monitoring of 177<br />
multibuilding 66<br />
ports 193<br />
security 73<br />
subordinate servers 69<br />
See also <strong>Open</strong> <strong>Directory</strong> replica<br />
resource attribute 236<br />
resource object class 216<br />
resource usage 24<br />
RFC 2307 mapping 140, 154, 164<br />
root account 123, 124, 201<br />
S<br />
SACLs (service access control lists) 40, 73, 175<br />
SASL (Simple Authentication and Security Layer) 12,<br />
52<br />
See also <strong>Open</strong> <strong>Directory</strong> Password <strong>Server</strong><br />
schema attributes 236<br />
schemas, directory domain 26, 70, 158, 207, 208,<br />
209<br />
See also attributes; object classes; records<br />
search base, LDAP 27, 84, 147, 203<br />
searching<br />
LDAP 27, 84, 146, 186, 187, 203<br />
users and groups 28, 29<br />
search policies<br />
administrator 36<br />
advanced settings 128<br />
authentication 38, 128<br />
automatic 36, 129<br />
changing 131<br />
computers 37, 38<br />
contacts 38, 128<br />
custom 38, 130<br />
definition 30, 33<br />
DHCP 131<br />
LDAP 37<br />
levels 33, 34, 35<br />
local 131<br />
secure SHell. See SSH<br />
Secure Sockets Layer. See SSL<br />
security<br />
best practices 73<br />
certificates 69, 187, 188<br />
DHCP 131<br />
disabling authentication methods 54, 55<br />
firewalls 48, 73<br />
Kerberos 48, 194<br />
LDAP 40, 106, 145, 153, 184, 186, 187, 188<br />
root accounts 124<br />
SASL 12, 52<br />
search policies 38<br />
server policy settings 184<br />
SSL 56, 121, 187, 188<br />
user accounts 43<br />
See also authentication; passwords; permissions<br />
<strong>Server</strong> Admin 69, 76<br />
<strong>Server</strong> Assistant configuration object class 215<br />
<strong>Server</strong> Message Block. See SMB<br />
servers<br />
accessing 29, 174<br />
adding 121<br />
authentication 49, 73<br />
binding to 184<br />
editing 122<br />
hosting replicas on 89<br />
identifying 62<br />
Kerberos realm connections 102, 205<br />
monitoring 123<br />
ports for 73<br />
pseudo-master 69<br />
referrals 152<br />
remote 81, 126, 174<br />
removing 122<br />
restoring 195, 196<br />
security policy 184<br />
setup 94, 95, 252<br />
278 Index
subordinate 69<br />
unbinding from 168<br />
See also <strong>Open</strong> <strong>Directory</strong><br />
service access control lists. See SACLs<br />
service attributes 231, 234<br />
service object class 215<br />
setup procedures. See configuration<br />
shadow passwords<br />
authentication methods 52, 113<br />
changing to 110<br />
definition 41<br />
disabling 55<br />
features 44<br />
security issues 43<br />
Windows limitations 31, 42<br />
shared directory domains<br />
identifying servers 62<br />
introduction 28, 29<br />
NetInfo 32, 110, 118<br />
planning for 57, 58<br />
search policies 34, 35<br />
troubleshooting login 202<br />
user information 82<br />
See also LDAP<br />
share points 24, 126<br />
short name 182<br />
Simple Authentication and Security Layer. See SASL<br />
single sign-on authentication 11, 46, 48, 49, 71<br />
See also Kerberos<br />
slapconfig tool 195, 196<br />
SMB (<strong>Server</strong> Message Block) protocol service 30, 53<br />
SSH (secure SHell host) 73, 89, 174<br />
ssh tool 174<br />
SSL (Secure Sockets Layer) 56, 121, 187, 188<br />
standalone directory service. See local directory<br />
domains<br />
startup, problems with 201<br />
subordinate server 69<br />
T<br />
templates, LDAP mapping 148<br />
ticketbased authentication 48<br />
See also Kerberos<br />
tiered administration 75<br />
time synchronization 52, 63, 97, 203<br />
time-to-live attribute (TTL) 217<br />
time-to-live object class (TTL) 209<br />
troubleshooting<br />
Active <strong>Directory</strong> 200<br />
authentication 199, 201, 202, 203, 205, 206<br />
connections 201<br />
replication 199, 200<br />
trusted binding<br />
Active <strong>Directory</strong> 160<br />
definition 134<br />
options for 137<br />
policies 184<br />
setup 149<br />
stopping 143, 150<br />
TTL attribute. See time-to-live attribute<br />
two-level search policies 34<br />
U<br />
UIDs (user IDs) 69, 84, 157, 163<br />
UNIX<br />
configuration files 21, 23<br />
crypt passwords 110<br />
group ID mapping 164<br />
RFC 2307 mapping 140<br />
security issues 43<br />
UNIX shell attribute 163<br />
upgrading <strong>Mac</strong> <strong>OS</strong> X <strong>Server</strong> 67, 118<br />
URLs (Uniform Resource Locators) 231<br />
user accounts<br />
accessing 157<br />
deleting 181<br />
directory domains 58, 71, 82<br />
editing 168<br />
exporting 117<br />
finding 28, 29<br />
importing 117, 183<br />
passwords 56, 201<br />
root 123, 124, 201<br />
security 43<br />
user names 84<br />
See also group accounts; passwords; users<br />
user attributes 217, 233, 253, 257<br />
user IDs. See UIDs<br />
user name 84<br />
user object classes 209<br />
users<br />
access control 157, 173, 174, 201<br />
authentication 40, 45, 46, 99<br />
cross-domain authorization 69<br />
directory domain uses 24, 28, 29<br />
directory service benefits 19<br />
login 85, 219<br />
mappings 154, 163, 238, 249, 250<br />
migration of 118<br />
object classes 209, 214<br />
permissions 75, 152, 155<br />
preferences storage 24<br />
record types 249, 250<br />
troubleshooting authentication 201, 202, 203,<br />
205<br />
Windows 30, 31, 86<br />
See also clients; home folders; user accounts;<br />
Workgroup Manager<br />
Index 279
V<br />
VPN (Virtual Private Network) 53, 67, 202<br />
W<br />
WebDAV-Digest authentication 53, 56<br />
Windows 2000 setup 87<br />
Windows domain<br />
BDC 32, 85, 91<br />
<strong>Open</strong> <strong>Directory</strong> setup for 85, 86, 87<br />
passwords 31, 42, 44<br />
PDC 31, 85, 86, 87<br />
See also Active <strong>Directory</strong>; SMB<br />
Windows XP setup 86, 87<br />
Workgroup Manager<br />
authentication role 105<br />
deleting user accounts 181<br />
editing directory data 179<br />
functions of 77<br />
Inspector 179, 180, 181<br />
LDAP directories 155<br />
and <strong>Open</strong> <strong>Directory</strong> 20<br />
X<br />
XML plist attribute 231<br />
280 Index